weir-harness 1.2.0 → 1.2.1

package/src/capabilities/store/checked-contract.d.ts

@@ -8,6 +8,7 @@ declare module 'node:fs' {
   export function renameSync(from: string, to: string): void;
   export function unlinkSync(path: string): void;
   export function fsyncSync(fd: number): void;
+  export function linkSync(existingPath: string, newPath: string): void;
 }
 declare module 'node:fs/promises' {
   export function link(existingPath: string, newPath: string): Promise<void>;
@@ -23,10 +24,14 @@ declare module 'node:child_process' {
 }
 declare module 'node:os' {
   export function hostname(): string;
+  export function homedir(): string;
 }
 declare var process: {
   pid: number;
   platform: string;
+  execPath: string;
+  cwd(): string;
+  env: Record<string, string | undefined>;
   kill(pid: number, signal?: number): void;
 };
 

package/src/capabilities/store/fs-adapter.js

@@ -106,3 +106,55 @@ export function instrumentFs(inner, hook) {
   }
   return /** @type {StoreFs} */ (wrapped)
 }
+
+// ---- Synchronous counterpart (capabilities-deepening D4) ---------------------
+// The lifecycle listener may not yield the event loop (G4b), so the store's
+// sync commit/read path needs blocking I/O with the SAME durability
+// discipline as the async Adapter above: full-content write, file fsync,
+// link/rename publication, directory fsync (POSIX-only — the same platform
+// stance as fsyncDir). One seam, so a test can wrap these calls exactly like
+// instrumentFs wraps the async ones.
+
+import { closeSync, fsyncSync, linkSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs'
+
+/**
+ * @typedef {{
+ *   readTextSync(path: string): string,
+ *   writeFullSync(path: string, text: string): void,
+ *   fsyncFileSync(path: string): void,
+ *   linkSync(from: string, to: string): void,
+ *   renameSync(from: string, to: string): void,
+ *   unlinkSync(path: string): void,
+ *   mkdirpSync(path: string): void,
+ *   fsyncDirSync(path: string): void,
+ * }} StoreSyncFs
+ */
+
+/** @returns {StoreSyncFs} */
+export function createNodeSyncFs() {
+  return {
+    readTextSync: path => readFileSync(path, 'utf8'),
+    writeFullSync(path, text) { writeFileSync(path, text, { mode: 0o600 }) },
+    fsyncFileSync(path) {
+      const fd = openSync(path, 'r+')
+      try {
+        fsyncSync(fd)
+      } finally {
+        closeSync(fd)
+      }
+    },
+    linkSync: (from, to) => linkSync(from, to),
+    renameSync: (from, to) => renameSync(from, to),
+    unlinkSync: path => unlinkSync(path),
+    mkdirpSync(path) { mkdirSync(path, { recursive: true, mode: 0o700 }) },
+    fsyncDirSync(path) {
+      if (!DIR_SYNC_SUPPORTED) return
+      const fd = openSync(path, 'r')
+      try {
+        fsyncSync(fd)
+      } finally {
+        closeSync(fd)
+      }
+    },
+  }
+}

package/src/capabilities/store/lock.js

@@ -264,3 +264,89 @@ export function createLockProtocol(options) {
 
   return { acquire, release, cleanup, inspect, clear }
 }
+
+// ---- Synchronous nominal-lease variant (capabilities-deepening D4) -----------
+// For callers that may not yield the event loop (the agent/created lifecycle
+// listener): the SAME publication convention as the async protocol above —
+// private candidate + fsync + link (EEXIST = contention), the same OwnerDoc
+// schema, remove-only-if-ours release — but with NO backoff and NO
+// reclamation: contention fails closed, and a crashed holder's leftover lock
+// becomes reclaimable to the async protocol after the nominal lease expires
+// ('sync-capture' marks an owner whose start identity was never probed, so a
+// same-process leftover reads as dead once the lease lapses).
+
+import { hostname } from 'node:os'
+import { createNodeSyncFs } from './fs-adapter.js'
+
+/** Nominal lease of a synchronously acquired lock (acquired, used, released in one segment). */
+export const SYNC_LOCK_LEASE_MS = 10_000
+
+/**
+ * @param {{ fs?: import('./fs-adapter.js').StoreSyncFs, now?: () => number, token?: () => string }} [options]
+ */
+export function createSyncLock(options = {}) {
+  const fs = options.fs ?? createNodeSyncFs()
+  const now = options.now ?? Date.now
+  const token = options.token ?? (() => randomBytes(12).toString('hex'))
+
+  /**
+   * Acquire `<dir>/<name>.lock` synchronously or fail closed. Never writes
+   * the unit record. Contention (EEXIST) is a 'locked' refusal, not a wait.
+   * @param {string} dir @param {string} name
+   * @returns {{ ok: true, token: string } | { ok: false, reason: 'locked' }}
+   */
+  function acquire(dir, name) {
+    const ownerToken = token()
+    const lockFile = join(dir, `${name}.lock`)
+    const candidate = `${lockFile}.${ownerToken}.cand`
+    const at = now()
+    /** @type {OwnerDoc} */
+    const doc = {
+      schemaVersion: LOCK_SCHEMA_VERSION,
+      ownerToken,
+      pid: process.pid,
+      host: hostname(),
+      startIdentity: { osStart: null, bootNonce: 'sync-capture' },
+      acquiredAt: at,
+      leaseUntil: at + SYNC_LOCK_LEASE_MS,
+    }
+    try {
+      fs.writeFullSync(candidate, JSON.stringify(doc))
+      fs.fsyncFileSync(candidate)
+      fs.linkSync(candidate, lockFile)
+    } catch (error) {
+      try { fs.unlinkSync(candidate) } catch { /* the candidate may never have landed */ }
+      // EEXIST = the lock is held; ENOENT = the holder's orphan sweep removed
+      // our candidate mid-race (the async publish() convention) — both mean
+      // this round is lost, and the caller fails closed or retries.
+      if (hasCode(error, 'EEXIST', 'ENOENT')) return { ok: false, reason: /** @type {const} */ ('locked') }
+      throw error
+    }
+    // Candidate cleanup is best-effort (the async publish() convention): a
+    // leftover candidate is swept by the next async acquire's cleanup.
+    try { fs.unlinkSync(candidate) } catch { /* best effort */ }
+    return { ok: true, token: ownerToken }
+  }
+
+  /** Remove `<dir>/<name>.lock` only while it still names our token. @param {string} dir @param {string} name @param {string} ownerToken */
+  function release(dir, name, ownerToken) {
+    const lockFile = join(dir, `${name}.lock`)
+    let text
+    try {
+      text = fs.readTextSync(lockFile)
+    } catch (error) {
+      if (hasCode(error, 'ENOENT')) return false
+      throw error
+    }
+    const doc = parseOwnerDoc(text)
+    if (doc.kind === 'ok' && doc.value.ownerToken !== ownerToken) return false
+    try {
+      fs.unlinkSync(lockFile)
+    } catch (error) {
+      if (!hasCode(error, 'ENOENT')) throw error
+    }
+    return true
+  }
+
+  return { acquire, release }
+}

package/src/capabilities/store/paths.js

@@ -33,6 +33,7 @@ export function resolveStoreRoot(profileContext) {
  * @typedef {{ kind: 'selection', sessionId: string }
  *   | { kind: 'content', sessionId: string }
  *   | { kind: 'inherited', sessionId: string }
+ *   | { kind: 'notice', sessionId: string }
  *   | { kind: 'defaults', workspaceKey: string }
  *   | { kind: 'preset', scope: 'global', presetId: string }
  *   | { kind: 'preset', scope: 'workspace', workspaceKey: string, presetId: string }
@@ -55,6 +56,10 @@ export function unitLayout(unit) {
     case 'selection':
     case 'content':
     case 'inherited':
+    // The pending model-facing notice (durable-pending-notice D1): its own
+    // unit, so the accepted selection record's revision — the client's CAS
+    // token — is never touched by delivery bookkeeping. Absent = nothing owed.
+    case 'notice':
       need(u.sessionId)
       return layout(['sessions', /** @type {string} */ (u.sessionId)], u.kind)
     case 'defaults':

package/src/capabilities/store/store.js

@@ -2,10 +2,14 @@
 // read(unit), commit(unit, expectedRevision, mutate) and publishPointer(scope,
 // next). Locking, stale-lock reclamation, temp cleanup, schema checks and the
 // platform gate stay inside; the filesystem Adapter is the only seam.
+// A committed result also reports the payload its CAS replaced (`committedOver`,
+// read under the same per-unit lock that performed the write): the store is the
+// only component that can prove a write's "before" state without a race, so no
+// caller may re-derive it from an unlocked read.
 import { join } from 'node:path'
-import { createNodeFs } from './fs-adapter.js'
+import { createNodeFs, createNodeSyncFs } from './fs-adapter.js'
 import { createLiveness } from './liveness.js'
-import { createLockProtocol } from './lock.js'
+import { createLockProtocol, createSyncLock } from './lock.js'
 import { validPresetPayload } from './enumerate.js'
 import { isFileSegment, isSegment, resolveStoreRoot, unitLayout } from './paths.js'
 import { decodeRecord, digestOf, encodeRecord } from './record.js'
@@ -23,7 +27,7 @@ export const SUPPORTED_PLATFORMS = Object.freeze(['darwin', 'win32'])
  * @typedef {import('./record.js').Receipt} Receipt
  * @typedef {import('./record.js').RecordRead} RecordRead
  * @typedef {{ requestId?: string, requestDigest?: string }} RequestRef
- * @typedef {{ status: 'committed', revision: number, payload: unknown, receipt: Receipt|null }
+ * @typedef {{ status: 'committed', revision: number, payload: unknown, receipt: Receipt|null, committedOver: unknown }
  *   | { status: 'duplicate', revision: number, receipt: Receipt }
  *   | { status: 'revision-conflict', revision: number }
  *   | { status: 'request-conflict', receipt: Receipt }
@@ -61,6 +65,11 @@ export function openCapabilityStore(options) {
     ? { supported: false, reason: `platform-unsupported:${platform}` }
     : /** @type {any} */ (located)
   const lock = createLockProtocol({ fs, liveness, leaseMs: options.leaseMs, deadlineMs: options.deadlineMs, now, token: options.token })
+  // The synchronous path (capabilities-deepening D4): same root/layout/record
+  // schema, the sync fs counterpart and the nominal-lease sync lock — acquired,
+  // used and released in one blocking segment, contention fails closed.
+  const syncFs = options.syncFs ?? createNodeSyncFs()
+  const syncLock = createSyncLock({ fs: syncFs, now, token: options.token })
   /** @type {Map<string, Promise<unknown>>} */
   const queues = new Map()
 
@@ -243,7 +252,9 @@ export function openCapabilityStore(options) {
           const settled = await readRecord(record).catch(() => null)
           if (settled?.kind !== 'ok' || settled.digest !== next.digest) return { status: 'write-failed', error }
         }
-        return { status: 'committed', revision, payload, receipt }
+        // The payload the CAS replaced, read under this same lock — the only
+        // provable "before" authority of this write (undefined: no record).
+        return { status: 'committed', revision, payload, receipt, committedOver: current.kind === 'ok' ? current.payload : undefined }
       } finally {
         await lock.release(dir, layout.name, acquired.token).catch(() => {})
       }
@@ -302,5 +313,94 @@ export function openCapabilityStore(options) {
     return serialize(layout.key, () => lock.clear(dir, layout.name, which, ownerToken))
   }
 
-  return { support, read, commit, publishPointer, inspect, clear, withPresetNamespace, withSelectionSnapshot }
+  /** Synchronous record read — the same decode/fail-closed semantics as
+   * readRecord, blocking. @param {string} path @returns {RecordRead} */
+  function readRecordSync(path) {
+    let text
+    try {
+      text = syncFs.readTextSync(path)
+    } catch (error) {
+      if (hasCode(error, 'ENOENT')) return { kind: 'absent', revision: 0 }
+      throw error
+    }
+    return decodeRecord(text)
+  }
+
+  /**
+   * Synchronous read (capabilities-deepening D4): the listener path may not
+   * yield the event loop. Same unit layout, same record schema, same
+   * fail-closed kinds as the async read.
+   * @param {Unit} unit
+   * @returns {RecordRead | { kind: 'unsupported', reason: string }}
+   */
+  function readSync(unit) {
+    const { record } = locate(unit)
+    if (!support.supported) return { kind: 'unsupported', reason: support.reason }
+    return readRecordSync(record)
+  }
+
+  /**
+   * Synchronous CAS commit (capabilities-deepening D4), mirroring transact's
+   * step order: lock → dedup the request receipt → CAS the revision → mutate
+   * → temp+fsync → rename → directory fsync. The sync lock is the nominal-
+   * lease convention (acquired, used, released in one blocking segment):
+   * contention fails closed as 'locked' — never a backoff, never a second
+   * reclamation protocol. `mutate` must be synchronous.
+   * @param {Unit} unit
+   * @param {number} expectedRevision
+   * @param {(payload: unknown, info: { revision: number }) => unknown} mutate
+   * @param {RequestRef} [request]
+   * @returns {CommitResult}
+   */
+  function commitSync(unit, expectedRevision, mutate, request = {}) {
+    const { layout, dir, record } = locate(unit)
+    if (!support.supported) return { status: 'unsupported', reason: support.reason }
+    const { requestId, requestDigest } = request
+    if (requestId !== undefined && (typeof requestId !== 'string' || requestId.length === 0 || typeof requestDigest !== 'string')) {
+      throw new TypeError('requestId requires a non-empty id and a requestDigest')
+    }
+    syncFs.mkdirpSync(dir)
+    const acquired = syncLock.acquire(dir, layout.name)
+    if (!acquired.ok) return { status: 'locked', reason: acquired.reason }
+    try {
+      const current = readRecordSync(record)
+      if (current.kind !== 'ok' && current.kind !== 'absent') return { status: 'unreadable', kind: current.kind }
+      const receipts = current.kind === 'ok' ? current.receipts : []
+      if (requestId !== undefined) {
+        const prior = receipts.find(r => r.requestId === requestId)
+        if (prior) return prior.requestDigest === requestDigest ? { status: 'duplicate', revision: prior.revision, receipt: prior } : { status: 'request-conflict', receipt: prior }
+      }
+      if (current.revision !== expectedRevision) return { status: 'revision-conflict', revision: current.revision }
+      const revision = current.revision + 1
+      const payload = mutate(current.kind === 'ok' ? current.payload : undefined, { revision: current.revision })
+      /** @type {Receipt|null} */
+      const receipt = requestId === undefined ? null : { requestId, requestDigest: /** @type {string} */ (requestDigest), revision, acceptedAt: now() }
+      const next = encodeRecord(revision, payload, receipt ? [...receipts, receipt] : receipts)
+      const temp = join(dir, `${layout.name}.${acquired.token}.tmp`)
+      try {
+        syncFs.writeFullSync(temp, JSON.stringify(next))
+        syncFs.fsyncFileSync(temp)
+      } catch (error) {
+        try { syncFs.unlinkSync(temp) } catch { /* the temp may never have landed */ }
+        return { status: 'write-failed', error }
+      }
+      try {
+        syncFs.renameSync(temp, record)
+        syncFs.fsyncDirSync(dir)
+      } catch (error) {
+        try { syncFs.unlinkSync(temp) } catch { /* the temp may never have landed */ }
+        if (hasCode(error, 'EXDEV')) return { status: 'unsupported', reason: 'cross-device' }
+        // Same indeterminate settle-check as the async path: the rename may or
+        // may not have landed — only a digest match proves it did.
+        let settled
+        try { settled = readRecordSync(record) } catch { settled = null }
+        if (settled?.kind !== 'ok' || settled.digest !== next.digest) return { status: 'write-failed', error }
+      }
+      // Same committed-over authority as the async path (one typedef, both writes).
+      return { status: 'committed', revision, payload, receipt, committedOver: current.kind === 'ok' ? current.payload : undefined }
+    } finally {
+      try { syncLock.release(dir, layout.name, acquired.token) } catch { /* release is best-effort */ }
+    }
+  }
+  return { support, read, commit, commitSync, readSync, publishPointer, inspect, clear, withPresetNamespace, withSelectionSnapshot }
 }

package/src/delegate/group-coordinator.js

@@ -1,6 +1,7 @@
 // Supervised group coordinator: registry state machine for grouped delegation.
 // Pure logic (no DSH imports) — the mount layer (index.js/tool.js) feeds it
 // session events and injects the effectors (sendMessage/interrupt/timers).
+import { isTerminalStatus, parseTerminalStatus } from '../shared/terminal-evidence.js'
 
 export const SUPERVISION_CONTRACT = `
 
@@ -30,15 +31,6 @@ export const DEFAULT_SUPERVISION = {
 /** Bounded wait for the last settlement notice before the fallback delivery. */
 export const SIGNAL_FALLBACK_MS = 1000
 
-/** Parse a child's final assistant text into a terminal status, or null. */
-export function parseTerminalStatus(text) {
-  if (typeof text !== 'string' || text.length === 0) return null
-  const match = /^STATUS:[ \t]*(completed|blocked)[ \t]*$/m.exec(text)
-  if (!match) return null
-  const reportMatch = /^REPORT:[ \t]*([\s\S]*)$/m.exec(text.slice(match.index))
-  return { status: match[1], report: (reportMatch?.[1] ?? '').trim() }
-}
-
 /**
  * Canonical member record shape: eight fields, fixed order. The single source
  * every construction site converges on (registerMember, hydrate, rehydrate).
@@ -54,14 +46,6 @@ export function createGroupRecord(name, { sealed = false, settled = false, membe
   return { name, memberIds: [...memberIds], sealed, settled }
 }
 
-/**
- * Single exit for the terminal-status predicate: statuses that count toward
- * group completion (blocked waits for a resume, so it is NOT terminal here).
- */
-export function isTerminalStatus(status) {
-  return status === 'completed' || status === 'terminated'
-}
-
 /**
  * Single exit for the untracked-catalog predicate: continuable catalog entries
  * the registry does not track. mode is normalized (undefined → 'continuable');

package/src/delegate/index.js

@@ -1,7 +1,9 @@
 // Weir delegate plugin: category registry + curated agents + the delegate
 // tool. Plain ESM, ctx-only. Composition root: all policy lives in the sibling
 // modules (settings-overlay / target-resolver / supervision-tools /
-// supervision-mount / audit-readers); apply() only constructs and wires them.
+// supervision-mount); apply() only constructs and wires them. The terminal-
+// evidence cold readers live in src/shared/terminal-evidence.js (shared with
+// the worktree plugin).
 import { CURATED_AGENTS } from './agents.js'
 import { createSettingsOverlay } from './settings-overlay.js'
 import { createTargetResolver } from './target-resolver.js'
@@ -11,7 +13,7 @@ import { skillSelectionFor } from '../capabilities/skill-selection-plugin.js'
 import { createResumeTool, createTerminateTool } from './supervision-tools.js'
 import { mountSupervision } from './supervision-mount.js'
 import { createAudit } from '../shared/audit.js'
-import { FALLBACK_TABLES } from '../shared/whitelist-defaults.js'
+import { FALLBACK_TABLES } from './whitelist-defaults.js'
 import { createDelegateTool } from './tool.js'
 import { attachWorktreeModeGuard } from './worktree-mode.js'
 import { DOCTRINE_SECTION_ORDER } from '../core/doctrine.js'

package/src/delegate/rehydrate.js

@@ -2,7 +2,8 @@
 // restart. Pure logic — the mount layer feeds it parsed audit records and the
 // DSH catalog; no DSH imports, no fs.
 
-import { parseTerminalStatus, createMemberRecord, createGroupRecord, isTerminalStatus, untrackedCatalogEntries } from './group-coordinator.js'
+import { createMemberRecord, createGroupRecord, untrackedCatalogEntries } from './group-coordinator.js'
+import { parseTerminalStatus, isTerminalStatus } from '../shared/terminal-evidence.js'
 
 /**
  * Rebuild supervision state by replaying structured audit facts and

package/src/delegate/robash-guard-core.js

@@ -1,7 +1,7 @@
 // Read-only shell guard core: the single canonical home of every cross-shell
 // policy the bash and pwsh adapters share — the whitelist tables (one
 // representation, consumed by the guard adapters, delegate/index.js, and
-// shared/whitelist-defaults.js), the git gate, the GIT_CONFIG_* environment
+// whitelist-defaults.js), the git gate, the GIT_CONFIG_* environment
 // smuggle refusal, the recursion budget, the redirect sink policy, and the
 // per-executable verdict tail. Pure functions, no ctx access.
 //
@@ -10,7 +10,7 @@
 // the three & roles, alias expansion), so the scanners are not merged.
 
 /** Canonical whitelist tables, organized by the five published keys so
- * shared/whitelist-defaults.js derives FALLBACK_TABLES with zero translation.
+ * whitelist-defaults.js derives FALLBACK_TABLES with zero translation.
  * Entries moved verbatim from the former DEFAULT_ROBASH (robash-guard.js) and
  * DEFAULT_ROBASH_PWSH (robash-guard-pwsh.js); pwsh entries keep their original
  * casing (the pwsh adapter lowercases at lookup) so the shipped

package/src/delegate/supervision-mount.js

@@ -4,9 +4,9 @@
 // into live coordinators. This module is a ctx adapter — per the jsconfig
 // purity curation it stays out of include (same precedent as index.js and
 // group-coordinator.js).
-import { createGroupCoordinator, isTerminalStatus } from './group-coordinator.js'
+import { createGroupCoordinator } from './group-coordinator.js'
 import { rehydrateSupervision, applyChildLogRecovery } from './rehydrate.js'
-import { auditFilePathOf, readAuditTail, readChildFinalText } from './audit-readers.js'
+import { auditFilePathOf, isTerminalStatus, readAuditTail, readChildFinalText } from '../shared/terminal-evidence.js'
 import { AUDIT_TYPES } from '../shared/audit.js'
 import { userTextMessage } from '../shared/user-message.js'
 import { contentText } from '../shared/content-text.js'
@@ -75,8 +75,9 @@ export function mountSupervision({ ctx, audit, settings, supervisionNow, onChild
             audit(parent.session, `${AUDIT_TYPES.supervision}/${fact.kind}`, fact)
             // A settled or terminated member frees its worktree lane (the host
             // checks the lane) — TERMINAL outcomes only (resumable-lane-workers
-            // D1): a blocked member stands by for resume_agent, so its binding
-            // must survive; the blocked fact still rides the audit channel.
+            // D1), with terminality defined by the shared isTerminalStatus
+            // predicate: a blocked member's binding must survive a possible
+            // resume; the blocked fact still rides the audit channel.
             // Deferred: never run lane work inside the fact.
             const settlesLane = fact.kind === 'terminate' || (fact.kind === 'settle' && isTerminalStatus(fact.status))
             if (settlesLane && !handoffs.has(fact.childId)) {

package/src/delegate/tool.js

@@ -3,6 +3,7 @@
 // @deepseek-ai packages do not resolve from a linked bundle).
 import { parseEscalation } from './escalate.js'
 import { continuableLane, oneShotLane, spawnGuardedChild, supervisedLane } from './spawn-adapter.js'
+import { WORKTREE_CODES } from '../worktree/errors.js'
 import { contentText } from '../shared/content-text.js'
 import { settleDelegateEditLifecycle } from '../shared/delegate-edit-lifecycle.js'
 
@@ -473,16 +474,38 @@ async function laneBindingFor(target, args, deps, exec) {
   }
 }
 
-/** Spawn under a reserved binding: commit the child id, or roll back on failure. */
+/**
+ * Spawn under a reserved binding: commit the child id, or roll back on
+ * failure. A commit refusing LANE_RESERVATION_LOST means the reservation was
+ * reclaimed while the child spawned (lane-binding-authoritative-commit): the
+ * child was never authorised, so it is disposed BEFORE the error surfaces
+ * (one-shot dispose precedent: spawn-adapter.js onGuardFailure). The rollback
+ * afterwards is a nonce-conditional no-op by then (D5). A spawn failure has
+ * no child to tear down; supervised-group commits roll back in the group
+ * catch (terminate per member), never here.
+ */
 async function spawnBound(binding, spawn, idOf) {
+  let started
+  try {
+    started = await spawn()
+  } catch (error) {
+    await binding?.rollback().catch(() => {})
+    throw error
+  }
   try {
-    const started = await spawn()
     await binding?.commit(idOf(started))
-    return started
   } catch (error) {
+    if (/** @type {any} */ (error)?.code === WORKTREE_CODES.LANE_RESERVATION_LOST) {
+      try {
+        await started.dispose?.()
+      } catch {
+        // best-effort teardown of the unauthorised child
+      }
+    }
     await binding?.rollback().catch(() => {})
     throw error
   }
+  return started
 }
 
 /** Lane guard spec with the path resolver bound to the parent's cwd. */

package/src/{shared → delegate}/whitelist-defaults.js

@@ -23,7 +23,7 @@
 // so tests can drive it without a runtime.
 
 import { readFileSync } from 'node:fs'
-import { DEFAULT_TABLES } from '../delegate/robash-guard-core.js'
+import { DEFAULT_TABLES } from './robash-guard-core.js'
 /** @typedef {{ readFile?: (path: string | URL) => string, logger?: { warn?: (message: string) => void } }} ReaderOptions */
 
 /** The five table names, in the order they are published. */
@@ -51,7 +51,7 @@ export const FALLBACK_TABLES = Object.freeze({
 /**
  * The shipped defaults file, resolved against THIS module's location so it
  * travels with the bundle rather than with whatever working directory the host
- * happens to have. `src/shared/` → bundle root.
+ * happens to have. `src/delegate/` → bundle root.
  */
 export const DEFAULT_WHITELIST_PATH = new URL('../../whitelist-defaults.json', import.meta.url)
 

package/src/edit-lock/admin-ledger.js

@@ -2,6 +2,7 @@
 // of publication outcome or old-writer quiescence. It lives in the atomic image.
 import { createHash } from 'node:crypto'
 import { canonical } from './snapshot.js'
+import { revokedOwner } from './derived-facts.js'
 import { expectedRegistry, isRegistryUpgrade } from './incarnations.js'
 
 export const LATE_WRITER_RISK = 'Detached historic writers may still modify files after this override.'
@@ -12,17 +13,13 @@ export const ONLINE_RECOVERY_ACTOR = 'online-administrator'
  * settlement (design D3) are the only writers. */
 const ACTORS = ['authenticated-settings-administrator', AUTOMATIC_RECOVERY_ACTOR, ONLINE_RECOVERY_ACTOR]
 export const digest = value => createHash('sha256').update(canonical(value)).digest('hex')
-export const dispositionFor = (state, op) => state.adminRecoveries?.find(row => row.owner === op.sessionId && row.operations.some(item => item.operationId === op.operationId))
-/** Epoch-scoped revocation: a disposition revokes its owner's execution
- * authority exactly at the recorded revokedEpoch. The owner stays revoked
- * while its recorded epoch is within it; a trusted resume advances the epoch
- * past every revokedEpoch and ends the revoked state atomically, without any
- * ledger change (append-only: dispositions are never removed or altered). */
-export const revokedOwner = (state, owner) => {
-  const session = state.sessions?.find(s => s.sessionId === owner)
-  if (!session) return false
-  return state.adminRecoveries?.some(row => row.owner === owner && session.executionEpoch <= row.revokedEpoch) === true
-}
+// Epoch-scoped revocation (`revokedOwner`) and the disposition lookup
+// (`dispositionFor`) live in derived-facts.js (change edit-lock-deepening,
+// design D1) — one pure home shared by the manager status path, the cold view
+// and the inspector; `revokedOwner` is imported above for this module's own
+// validation. The re-export keeps existing external importers working (the
+// integration scenario child imports dispositionFor from this module).
+export { dispositionFor, revokedOwner } from './derived-facts.js'
 
 function requireThat(condition, message) { if (!condition) throw new Error(`invalid administrative recovery: ${message}`) }
 function keys(value, names) {

package/src/edit-lock/admin-recovery.js

@@ -6,7 +6,8 @@ import { createHash } from 'node:crypto'
 import { reservePublisher } from './reservation.js'
 import { openEditLockStore } from './store.js'
 import { canonical, parseSnapshot, validateImage } from './snapshot.js'
-import { administrativeState, digest, dispositionFor, LATE_WRITER_RISK } from './admin-ledger.js'
+import { administrativeState, digest, LATE_WRITER_RISK } from './admin-ledger.js'
+import { dispositionFor } from './derived-facts.js'
 
 export const MAX_RECOVERY_BYTES = 16 * 1024 * 1024
 const sha256 = bytes => createHash('sha256').update(bytes).digest('hex')

package/src/edit-lock/admission.js

@@ -2,8 +2,15 @@ import { posix, win32 } from 'node:path'
 
 /** Candidates describe effects, not merely explicit API arguments. Session-wide
  * operations must enumerate affected ownership at their FIFO position.
+ * Modes: 'normal' covers every mutating ingress; 'release' is pure removal and
+ * must retain the ownership unresolved updates require; 'revocation' is strictly
+ * subtractive and crosses fences. 'resume' is reserved for session-level
+ * recovery transactions (the trusted Continue): it publishes nothing, so an
+ * unresolved resource-level fence never denies it, while domain fences and
+ * every shape denial bind it exactly as they bind 'normal'. It must never be
+ * used for a transaction that publishes, confirms, acquires or releases.
  * @typedef {{kind: 'resources', resourceIds: string[]} | {kind: 'scope', ancestor: string} | {kind: 'none'}} Candidate
- * @typedef {'normal'|'release'|'revocation'} Mode
+ * @typedef {'normal'|'release'|'revocation'|'resume'} Mode
  */
 
 /** Shape check only, NOT filesystem proof. The trusted manager ingress already
@@ -59,7 +66,10 @@ export function admitMutation(operations, candidate, mode = 'normal') {
       for (const resourceId of candidate.resourceIds) {
         if (!canonicalResource(resourceId)) deny('identity-unproved')
         if (fence?.kind !== 'resource') deny('scope-continuity-unproved')
-        if (fence?.kind === 'resource' && (!canonicalResource(fence.resourceId) || fence.resourceId === resourceId)) deny('resource-conflict')
+        // 'resume' publishes nothing: a resource-level fence never bars the
+        // session-level recovery transaction; it keeps barring the resource
+        // itself on every other mode until administrative settlement.
+        if (mode !== 'resume' && fence?.kind === 'resource' && (!canonicalResource(fence.resourceId) || fence.resourceId === resourceId)) deny('resource-conflict')
       }
     }
   }