simt-dev 0.6.3 → 0.7.1

package/src/journal.mjs

@@ -1,20 +1,29 @@
-// The write journal and `undo` (plan 0003 R49).
+// The write journal and `undo` (plan 0003 R49, entry kinds review 0003 Q22).
 //
-// Every repo-file write a command performs records {path, beforeDigest,
-// afterDigest, beforeBytes}, grouped per command run as one set in
-// `.simt/journal/`. `undo` restores the last set, but only when every file in
-// it is untouched since — a file whose current bytes no longer match its
-// afterDigest refuses the whole undo, naming the file, and nothing is restored.
+// Every write a command performs is recorded as one entry in the run's set:
+// `file` entries hold the pre-run bytes as base64 with the pre-run permission
+// bits (binary-safe, unlike the version-1 utf8 spelling), and `git-config`
+// entries hold one config key's before and after values, so `undo` restores
+// the routing a run changed as well as the bytes. `commitJournal` folds each
+// path and each key to a single entry — first before, last after — and `undo`
+// restores entries in reverse, skipping the ones already at their pre-run
+// state so a crashed undo resumes instead of refusing its own progress. The
+// write-ahead marker records that intent; verification still precedes any
+// restore on a fresh undo, so a refusal changes nothing.
 //
 // Three deliberate boundaries, each a failure this module refuses to be:
 //
 //   - The plan row says `.simt-dev/journal/`, which predates the STATE_DIR
 //     rename (the same stale spelling survives in bench/probes.mjs comments).
 //     The journal lives under STATE_DIR like every other per-repo state.
-//   - Nothing under `.simt/` is journaled. The journal recording itself is
-//     recursion; the ledger, index and candidates are evidence and caches, and
-//     restoring those to an earlier byte-shape would corrupt R17 rather than
-//     repair anything. `journaledWriteFile` performs those writes unrecorded.
+//   - Nothing under `.simt/` is journaled, one named exception: the shim
+//     directory. The journal recording itself is recursion; the ledger, index
+//     and candidates are evidence and caches, and restoring those to an earlier
+//     byte-shape would corrupt R17 rather than repair anything. The shims are
+//     the opposite of that: git's routing points at them, and the undo that
+//     restores the routing must restore the shims with it (review 0003 Q22;
+//     ADR-122 moved them under STATE_DIR). `journaledWriteFile` performs the
+//     other writes unrecorded.
 //   - Only regular files. Symlinks carry no bytes for beforeBytes to hold, and
 //     the record shape is file bytes — pointer changes are reported by the
 //     command as before and are not undone. Removals are journaled as entries
@@ -32,15 +41,30 @@
 // a second `undo` naturally targets the set before it, and the untouched-check
 // refuses when the two sets overlap on a file the first undo already restored.
 
+import { execFile } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { cp, mkdir, readFile, readdir, rename, stat, unlink, writeFile } from 'node:fs/promises';
+import { chmod, cp, mkdir, readFile, readdir, rename, rmdir, stat, unlink, writeFile } from 'node:fs/promises';
 import { dirname, join, relative, sep } from 'node:path';
+import { promisify } from 'node:util';
 
 import { STATE_DIR } from './name.mjs';
+import { LOCAL_DIR } from './state.mjs';
+import { HOOKS_DIR } from './hooks/shim.mjs';
 
-const JOURNAL_DIR = join(STATE_DIR, 'journal');
+const exec = promisify(execFile);
+
+const JOURNAL_DIR = join(LOCAL_DIR, 'journal');
+const JOURNAL_DIR_LEGACY = '.simt/journal';
 const SET_SUFFIX = '.json';
 const UNDONE_SUFFIX = '.undone.json';
+/** A crashed `undo` leaves its intent behind under this suffix; the next undo
+ * of the same set resumes it instead of starting over (review 0003 Q22). A
+ * marker is history, not a set, so the set listing excludes it. */
+const UNDOING_SUFFIX = '.undoing.json';
+/** Sets that predate entry kinds store `beforeBytes` as utf8 text and carry no
+ * `kind`; they are still restorable, through the legacy branch of the restore
+ * below. `commitJournal` only writes version 2. */
+const SET_VERSION = 2;
 
 function digest(bytes) {
   return `sha256-${createHash('sha256').update(bytes).digest('hex')}`;
@@ -51,18 +75,49 @@ function rel(root, path) {
 }
 
 /**
- * Read the current bytes of a path, or null when it does not exist. Any other
- * failure propagates: an unreadable file is fail-closed, not treated as absent.
+ * Read the current bytes and permission bits of a path, or null when it does
+ * not exist. Any other failure propagates: an unreadable file is fail-closed,
+ * not treated as absent.
  */
 async function readOrNull(path) {
   try {
-    return await readFile(path);
+    const [bytes, st] = await Promise.all([readFile(path), stat(path)]);
+    return { bytes, mode: st.mode & 0o777 };
   } catch (error) {
     if (error.code === 'ENOENT') return null;
     throw error;
   }
 }
 
+/**
+ * Record a file the run created with an exclusive create (`O_EXCL`).
+ *
+ * The create itself is the proof nothing was there before, so `before` is
+ * null by construction rather than by re-reading: a check-then-record would
+ * reopen the race the exclusive flag just closed. For ordinary overwrites use
+ * `journaledWriteFile`, which snapshots `before` itself.
+ */
+export function recordCreatedFile(root, acc, path, text) {
+  if (relative(root, path).startsWith('..')) {
+    throw new Error(`journal refuses a write outside the repository: ${path}`);
+  }
+  acc.push(fileEntry(rel(root, path), null, Buffer.from(text, 'utf8')));
+}
+
+/** A `file` entry: the pre-run bytes as base64 (binary-safe, unlike the
+ * version-1 utf8 spelling) with the pre-run permission bits, so `undo`
+ * restores both. Removals carry `afterDigest: null` and are re-created. */
+function fileEntry(path, before, after) {
+  return {
+    kind: 'file',
+    path,
+    beforeDigest: before === null ? null : digest(before.bytes),
+    afterDigest: after === null ? null : digest(after),
+    beforeBytes: before === null ? null : before.bytes.toString('base64'),
+    modeBefore: before === null ? null : before.mode,
+  };
+}
+
 /**
  * Write a repo file and record the write in the run's set.
  *
@@ -70,23 +125,30 @@ async function readOrNull(path) {
  * @param {Array} acc the run's set, created by the caller and committed once
  * @param {string} path absolute path to write
  * @param {string} text the bytes to write
+ * @param {{mode?: number}} [opts] permission bits to set after the write, recorded
+ *   in the entry — a shim written then chmodded is one change, not two, and
+ *   `undo` must restore the mode the run found, not just the bytes
  */
-export async function journaledWriteFile(root, acc, path, text) {
+export async function journaledWriteFile(root, acc, path, text, { mode } = {}) {
   if (relative(root, path).startsWith('..')) {
     throw new Error(`journal refuses a write outside the repository: ${path}`);
   }
   const before = await readOrNull(path);
-  // Internal state is written, not recorded — see the module header.
-  const internal = rel(root, path) === STATE_DIR || rel(root, path).startsWith(`${STATE_DIR}/`);
+  // Internal state is written, not recorded — see the module header, which
+  // names the shim directory as the one exception under STATE_DIR.
+  const r = rel(root, path);
+  const internal =
+    (r === STATE_DIR || r.startsWith(`${STATE_DIR}/`)) && r !== HOOKS_DIR && !r.startsWith(`${HOOKS_DIR}/`);
   await mkdir(dirname(path), { recursive: true });
-  await writeFile(path, text, 'utf8');
+  // tmp + rename, the way this module writes its own set files: a crash
+  // mid-write leaves the old bytes in place, never a half-written file
+  // (review 0003 Q25). The mode lands on the tmp, so the rename carries it.
+  const tmp = `${path}.tmp-${process.pid}`;
+  await writeFile(tmp, text, 'utf8');
+  if (mode !== undefined) await chmod(tmp, mode);
+  await rename(tmp, path);
   if (!internal) {
-    acc.push({
-      path: rel(root, path),
-      beforeDigest: before === null ? null : digest(before),
-      afterDigest: digest(Buffer.from(text, 'utf8')),
-      beforeBytes: before === null ? null : before.toString('utf8'),
-    });
+    acc.push(fileEntry(rel(root, path), before, Buffer.from(text, 'utf8')));
   }
 }
 
@@ -128,22 +190,12 @@ export async function journaledCopyDir(root, acc, src, dest) {
     const prev = before.get(path) ?? null;
     before.delete(path);
     const after = await readOrNull(abs);
-    if (prev !== null && after !== null && prev.equals(after)) continue;
-    acc.push({
-      path,
-      beforeDigest: prev === null ? null : digest(prev),
-      afterDigest: digest(after),
-      beforeBytes: prev === null ? null : prev.toString('utf8'),
-    });
+    if (prev !== null && after !== null && prev.bytes.equals(after.bytes)) continue;
+    acc.push(fileEntry(path, prev, after === null ? null : after.bytes));
   }
   // Files the copy removed (an overwrite that drops a name) are removals.
   for (const [path, prev] of before) {
-    acc.push({
-      path,
-      beforeDigest: digest(prev),
-      afterDigest: null,
-      beforeBytes: prev.toString('utf8'),
-    });
+    acc.push(fileEntry(path, prev, null));
   }
 }
 
@@ -158,16 +210,49 @@ export async function journaledRemoveFile(root, acc, path) {
   }
   const before = await readOrNull(path);
   if (before === null) return;
-  const internal = rel(root, path) === STATE_DIR || rel(root, path).startsWith(`${STATE_DIR}/`);
+  const r = rel(root, path);
+  const internal =
+    (r === STATE_DIR || r.startsWith(`${STATE_DIR}/`)) && r !== HOOKS_DIR && !r.startsWith(`${HOOKS_DIR}/`);
   await unlink(path);
   if (!internal) {
-    acc.push({
-      path: rel(root, path),
-      beforeDigest: digest(before),
-      afterDigest: null,
-      beforeBytes: before.toString('utf8'),
-    });
+    acc.push(fileEntry(rel(root, path), before, null));
+  }
+}
+
+/** Read one git config value in a repo, or null when unset. */
+export async function readGitValue(root, key) {
+  try {
+    const { stdout } = await exec('git', ['config', '--get', key], { cwd: root });
+    return stdout.replace(/\n$/, '');
+  } catch (error) {
+    if (error.code === 1) return null;
+    throw error;
+  }
+}
+
+/**
+ * Set (or, with `value: null`, unset) one git config key and record it as a
+ * `git-config` entry, so `undo` restores the routing a run changed — a shim
+ * without its `core.hooksPath` is a hook that no longer runs (review 0003
+ * Q22). A set to the value already there records nothing: there is no state
+ * to restore.
+ *
+ * @returns {Promise<object|null>} the entry, or null when nothing changed
+ */
+export async function journaledGitConfig(root, acc, key, value) {
+  if (typeof key !== 'string' || key === '' || /[\s]/.test(key)) {
+    throw new Error(`journal refuses an unparsable git config key: ${key}`);
+  }
+  const before = await readGitValue(root, key);
+  if (before === value) return null;
+  if (value === null) {
+    await exec('git', ['config', '--unset', key], { cwd: root });
+  } else {
+    await exec('git', ['config', key, value], { cwd: root });
   }
+  const entry = { kind: 'git-config', key, before, after: value };
+  acc.push(entry);
+  return entry;
 }
 
 /**
@@ -179,14 +264,19 @@ export async function journaledRemoveFile(root, acc, path) {
  */
 /**
  * The .gitignore bytes `ignoreJournal` would write for `text`, or null when
- * `text` already ignores the journal directory. One owner for the line
+ * `text` already ignores machine-local state. One owner for the line
  * spelling: `ignoreJournal` writes it, `journalHygiene` reads whether it is
  * there, and `doctor --fix --diff` previews it — all through this function so
  * the three cannot disagree about what counts as ignored (plan 0003 R50).
+ *
+ * The ignored line is the whole local area (review 0003 Q19), not just the
+ * journal: every machine-local write lives under it, and one line covers them.
  */
 export function journalIgnoreNext(text) {
-  const line = `${JOURNAL_DIR}/`;
-  if (text.split('\n').map((l) => l.trim()).includes(line)) return null;
+  const line = `${LOCAL_DIR}/`;
+  const legacy = `${JOURNAL_DIR_LEGACY}/`;
+  const lines = text.split('\n').map((l) => l.trim());
+  if (lines.includes(line) || lines.includes(legacy)) return null;
   const prefix = text === '' || text.endsWith('\n') ? '' : '\n';
   return `${text}${prefix}\n# Write journal for \`simt undo\`. Local state, never shared.\n${line}\n`;
 }
@@ -212,6 +302,93 @@ function setName(command, at) {
   return `${stamp}-${command}-${process.pid}.json`;
 }
 
+/**
+ * Fold one run's entries so each path (each config key) appears once: the
+ * first before, the last after. Two writes to one path used to refuse `undo`
+ * outright, although the run's net effect is a single restore. A create
+ * followed by a removal in the same run is no change at all and folds away;
+ * unequal ghosts — a removal folded with a write — fold to the write's after
+ * with the removal's before.
+ */
+function coalesceEntries(acc) {
+  const order = [];
+  const folded = new Map();
+  for (const entry of acc) {
+    const slot = entry.kind === 'git-config' ? `\0${entry.key}` : entry.path;
+    const prev = folded.get(slot);
+    if (prev === undefined) {
+      order.push(slot);
+      folded.set(slot, entry);
+      continue;
+    }
+    if (entry.kind === 'git-config') {
+      folded.set(slot, { ...entry, before: prev.before });
+    } else {
+      folded.set(slot, { ...entry, beforeDigest: prev.beforeDigest, beforeBytes: prev.beforeBytes, modeBefore: prev.modeBefore });
+    }
+  }
+  return order.map((slot) => folded.get(slot)).filter((entry) => {
+    if (entry.kind === 'git-config') return entry.before !== entry.after;
+    // Created then removed (or set back byte-for-byte, mode aside): nothing to restore.
+    return entry.beforeDigest !== null || entry.afterDigest !== null;
+  });
+}
+
+/**
+ * Move the sets that predate the move into `.simt/local/journal` (review 0003
+ * Q19's fallback directory) into the current directory, and take the legacy
+ * directory down when the move empties it. While the current directory is
+ * absent, `listJournalSets` falls back to the legacy one; once it exists, the
+ * two are disjoint and the legacy sets are invisible to `undo` — a repo that
+ * accumulated history under the old path loses it on its first write after the
+ * move (plan 0005 H3). `commitJournal` is the only writer, so the migration
+ * rides on it and heals on the next journal activity. Every legacy set
+ * predates every current set — the current directory is created by this
+ * writer — so the move cannot disturb recency order. A name present in both
+ * keeps both copies when the bytes differ: a set file is history, and a
+ * collision is not a reason to drop one of the two records. A crash mid-move
+ * splits the sets between the two directories; the move is idempotent, so the
+ * next call finishes it.
+ */
+async function migrateLegacyJournal(root) {
+  const legacy = join(root, JOURNAL_DIR_LEGACY);
+  let names;
+  try {
+    names = await readdir(legacy);
+  } catch (error) {
+    if (error.code !== 'ENOENT') throw error;
+    return;
+  }
+  const dir = join(root, JOURNAL_DIR);
+  await mkdir(dir, { recursive: true });
+  for (const name of names) {
+    // Sets, `.undone.json` history and `.undoing.json` markers all end in
+    // `.json`; a stray file of any other kind keeps the directory in place.
+    if (!name.endsWith(SET_SUFFIX)) continue;
+    const from = join(legacy, name);
+    const to = join(dir, name);
+    try {
+      await stat(to);
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+      await rename(from, to);
+      continue;
+    }
+    // The name is taken: equal bytes are a duplicate of the same set (drop the
+    // legacy copy); differing bytes are a collision (keep both — the current
+    // copy shadows the legacy one in the listing).
+    const [a, b] = await Promise.all([readFile(from), readFile(to)]);
+    if (a.equals(b)) await unlink(from);
+  }
+  // `rmdir` fails when the directory is not empty, which is exactly the
+  // safety: a stray file the move does not take keeps the directory.
+  try {
+    await rmdir(legacy);
+  } catch (error) {
+    if (error.code !== 'ENOTEMPTY' && error.code !== 'EEXIST') throw error;
+  }
+}
+
 /**
  * Persist a run's set. Writes nothing when the run changed nothing, so the
  * last set on disk is always the last run that wrote.
@@ -219,12 +396,14 @@ function setName(command, at) {
  * @returns {Promise<string|null>} the set id (file name), or null
  */
 export async function commitJournal(root, command, acc, { at = Date.now() } = {}) {
-  if (acc.length === 0) return null;
+  await migrateLegacyJournal(root);
+  const entries = coalesceEntries(acc);
+  if (entries.length === 0) return null;
   await ignoreJournal(root);
   const dir = join(root, JOURNAL_DIR);
   await mkdir(dir, { recursive: true });
   const id = setName(command, at);
-  const body = `${JSON.stringify({ version: 1, command, at, entries: acc }, null, 2)}\n`;
+  const body = `${JSON.stringify({ version: SET_VERSION, command, at, entries }, null, 2)}\n`;
   const tmp = join(dir, `${id}.tmp-${process.pid}`);
   await writeFile(tmp, body, 'utf8');
   await rename(tmp, join(dir, id));
@@ -246,71 +425,180 @@ export async function journalHygiene(root) {
   } catch {
     text = '';
   }
-  const line = `${JOURNAL_DIR}/`;
-  return { sets, ignored: text.split('\n').map((l) => l.trim()).includes(line) };
+  const lines = text.split('\n').map((l) => l.trim());
+  return { sets, ignored: lines.includes(`${LOCAL_DIR}/`) || lines.includes(`${JOURNAL_DIR_LEGACY}/`) };
 }
 
 /** Set ids newest-first, undone sets excluded. */
 export async function listJournalSets(root) {
+  // The pre-move directory is a fallback for one release (review 0003 Q19);
+  // the sets in it move into the current directory on the next write
+  // (`migrateLegacyJournal`, plan 0005 H3), so the fallback only serves a
+  // repo that has not written since the move.
   let names;
   try {
     names = await readdir(join(root, JOURNAL_DIR));
   } catch (error) {
-    if (error.code === 'ENOENT') return [];
-    throw error;
+    if (error.code !== 'ENOENT') throw error;
+    try {
+      names = await readdir(join(root, JOURNAL_DIR_LEGACY));
+    } catch (legacyError) {
+      if (legacyError.code === 'ENOENT') return [];
+      throw legacyError;
+    }
   }
   // An undone set ends in `.undone.json`, which itself ends in `.json` — the
   // suffix test alone would list history as current and `undo` would restore
-  // the same set twice. Exclude the undone first.
-  return names.filter((n) => n.endsWith(SET_SUFFIX) && !n.endsWith(UNDONE_SUFFIX)).sort().reverse();
+  // the same set twice. Exclude the undone (and the crash markers, which are
+  // intent, not sets) first.
+  return names
+    .filter((n) => n.endsWith(SET_SUFFIX) && !n.endsWith(UNDONE_SUFFIX) && !n.endsWith(UNDOING_SUFFIX))
+    .sort()
+    .reverse();
+}
+
+/** The directory holding set `id`, preferring the post-move one. */
+async function journalDirFor(root, id) {
+  try {
+    await stat(join(root, JOURNAL_DIR, id));
+    return JOURNAL_DIR;
+  } catch {
+    return JOURNAL_DIR_LEGACY;
+  }
 }
 
 export async function readJournalSet(root, id) {
-  const raw = await readFile(join(root, JOURNAL_DIR, id), 'utf8');
-  return JSON.parse(raw);
+  const dir = await journalDirFor(root, id);
+  const raw = await readFile(join(root, dir, id), 'utf8');
+  const set = JSON.parse(raw);
+  if (set.version !== SET_VERSION) {
+    // Version 1 stored `beforeBytes` as utf8 text and knew no kinds: read it
+    // through the legacy branch of the restore rather than refusing history.
+    return { ...set, entries: set.entries.map((e) => ({ ...e, kind: e.kind ?? 'file-legacy' })) };
+  }
+  return set;
+}
+
+/** The pre-run bytes of an entry as a string, for previews and diffs. */
+export function beforeText(entry) {
+  if (entry.kind === 'git-config' || entry.beforeBytes === null || entry.beforeBytes === undefined) return entry.before ?? null;
+  if (entry.kind === 'file-legacy') return entry.beforeBytes;
+  return Buffer.from(entry.beforeBytes, 'base64').toString('utf8');
+}
+
+/** The display name of an entry: a path for files, the key for config. */
+export function entryLabel(entry) {
+  return entry.kind === 'git-config' ? `git config ${entry.key}` : entry.path;
+}
+
+/** The digest of a file's current bytes, or null when absent. */
+function currentDigest(state) {
+  return state === null ? null : digest(state.bytes);
 }
 
 /**
- * Restore one set: verify every file is untouched since, then restore all.
- * Verification precedes any restore, so a refusal changes nothing.
+ * Whether an entry is already at its pre-run state — restored by an earlier
+ * attempt, or hand-set back to exactly what the run found. Restoring it again
+ * would be a no-op write, so a resumed undo skips it instead of refusing it.
+ */
+async function alreadyRestored(root, entry) {
+  if (entry.kind === 'git-config') {
+    return (await readGitValue(root, entry.key)) === entry.before;
+  }
+  const state = await readOrNull(join(root, entry.path));
+  return currentDigest(state) === entry.beforeDigest;
+}
+
+/** Whether an entry is still at the state the run left: the precondition for
+ * restoring it. Anything else is somebody's edit, and the undo is refused. */
+async function untouchedSince(root, entry) {
+  if (entry.kind === 'git-config') {
+    return (await readGitValue(root, entry.key)) === entry.after;
+  }
+  const state = await readOrNull(join(root, entry.path));
+  return currentDigest(state) === entry.afterDigest;
+}
+
+function entryBytes(entry) {
+  if (entry.beforeBytes === null) return null;
+  if (entry.kind === 'file-legacy') return Buffer.from(entry.beforeBytes, 'utf8');
+  return Buffer.from(entry.beforeBytes, 'base64');
+}
+
+/** Restore one entry: bytes and permission bits for files, the value for config. */
+async function restoreEntry(root, entry) {
+  if (entry.kind === 'git-config') {
+    await exec('git', entry.before === null ? ['config', '--unset', entry.key] : ['config', entry.key, entry.before], {
+      cwd: root,
+    });
+    return;
+  }
+  const abs = join(root, entry.path);
+  if (entry.afterDigest === null) {
+    // The run removed this path: re-create it with its pre-run bytes.
+    await mkdir(dirname(abs), { recursive: true });
+    await writeFile(abs, entryBytes(entry));
+  } else if (entry.beforeDigest === null) {
+    // The run created this path: remove it.
+    await unlink(abs);
+  } else {
+    await writeFile(abs, entryBytes(entry));
+  }
+  if (entry.modeBefore !== null && entry.modeBefore !== undefined) {
+    await chmod(abs, entry.modeBefore);
+  }
+}
+
+/**
+ * Restore one set: verify every entry is untouched since, then restore all in
+ * reverse — later writes in the run unwind first, so overlapping restores land
+ * in pre-run order.
+ *
+ * The intent lands on disk before the first restore (the write-ahead marker),
+ * so a crash mid-undo is resumable: entries already at their pre-run state
+ * are skipped, the rest are verified against the run's after-state and
+ * restored, and anything at neither refuses the whole undo. Verification
+ * still precedes any restore when there is no marker, so a refusal on a fresh
+ * undo changes nothing.
  *
- * @returns {Promise<{restored: string[]}|{refused: {path: string, detail: string}}>}
+ * @returns {Promise<{restored: string[], resumed: boolean}|{refused: {path: string, detail: string}}>}
  */
 async function undoJournalSet(root, id) {
   const set = await readJournalSet(root, id);
+  const dir = await journalDirFor(root, id);
+  const marker = join(root, dir, `${id}${UNDOING_SUFFIX}`);
+  const resumed = (await readOrNull(marker)) !== null;
   for (const entry of set.entries) {
-    const abs = join(root, entry.path);
-    const bytes = await readOrNull(abs);
-    const now = bytes === null ? null : digest(bytes);
-    if (now !== entry.afterDigest) {
+    if (await alreadyRestored(root, entry)) continue;
+    if (!(await untouchedSince(root, entry))) {
+      const label = entryLabel(entry);
       return {
         refused: {
-          path: entry.path,
+          path: label,
           detail:
-            bytes === null
-              ? 'the file was deleted after the journaled write'
-              : 'the file changed after the journaled write',
+            entry.kind === 'git-config'
+              ? `git config ${entry.key} changed after the journaled write`
+              : (await readOrNull(join(root, entry.path))) === null
+                ? 'the file was deleted after the journaled write'
+                : 'the file changed after the journaled write',
         },
       };
     }
   }
+  // The marker is the intent, written before anything is restored: a crash
+  // from here on resumes instead of refusing the files already done.
+  const tmp = `${marker}.tmp-${process.pid}`;
+  await writeFile(tmp, `${JSON.stringify({ version: 1, set: id, at: Date.now() }, null, 2)}\n`, 'utf8');
+  await rename(tmp, marker);
   const restored = [];
-  for (const entry of set.entries) {
-    const abs = join(root, entry.path);
-    if (entry.afterDigest === null) {
-      // The run removed this path: re-create it with its pre-run bytes.
-      await mkdir(dirname(abs), { recursive: true });
-      await writeFile(abs, entry.beforeBytes, 'utf8');
-    } else if (entry.beforeBytes === null) {
-      // The run created this path: remove it.
-      await unlink(abs);
-    } else {
-      await writeFile(abs, entry.beforeBytes, 'utf8');
-    }
-    restored.push(entry.path);
+  for (const entry of [...set.entries].reverse()) {
+    if (await alreadyRestored(root, entry)) continue;
+    await restoreEntry(root, entry);
+    restored.push(entryLabel(entry));
   }
-  await rename(join(root, JOURNAL_DIR, id), join(root, JOURNAL_DIR, id.replace(/\.json$/, UNDONE_SUFFIX)));
-  return { restored };
+  await unlink(marker);
+  await rename(join(root, dir, id), join(root, dir, id.replace(/\.json$/, UNDONE_SUFFIX)));
+  return { restored, resumed };
 }
 
 /**