weir-harness 1.2.3 → 2.1.0

package/src/edit-lock/index.js

@@ -1,1303 +0,0 @@
-// Weir Edit Lock composition. Disabled (zero behavior, no service) unless
-// enabled by the row config or the Weir settings `editLock.enabled` key
-// (read at mount; a change applies after restart). Plain ESM, ctx-only.
-//
-// Domains: each agent binds at creation to the management root of its session
-// cwd (git top level, else the cwd; an enclosing existing authority wins). The
-// authority lives in <root>/.weir/edit-lock and is excluded from git through
-// .git/info/exclude. The first host to reserve a root publishes for it; every
-// other cooperating host becomes its client over a local socket.
-//
-// Order contract: this row MUST precede hashline-edit and lsp. A mis-ordered
-// or unmanaged editor is not trusted: the pre-execute guard denies every
-// write/edit/hash_edit/lsp_rename definition not claimed through the service.
-import { existsSync, mkdirSync, readdirSync, realpathSync } from 'node:fs'
-import { isAbsolute, join } from 'node:path'
-import { openReservedEditLockRuntime } from './reserved-runtime.js'
-import { reservationPathFor } from './reservation.js'
-import { createEditLockLifecycle } from './lifecycle.js'
-import { installEditLockWriteScope } from './tool-scope.js'
-import { writeScopesFor } from './write-scopes.js'
-import { createBindingMachine } from './binding-machine.js'
-import { createResourceIdentity } from './resource-identity.js'
-import { userTextMessage } from '../shared/user-message.js'
-import { isGenuineUserMessage } from '../shared/runtime-messages.js'
-import { createAudit, AUDIT_TYPES } from '../shared/audit.js'
-import { createStaleSweepScheduler } from './stale-sweep.js'
-import { createRemoteEditLockDomain, endpointFor, serveEditLockEndpoint } from './remote.js'
-import { registerBindingRuntime, createBindingAttester } from './binding-attestation.js'
-import { localDomain, remoteDomain } from './domain.js'
-import { AUTHORITY_DIR, createDomainRegistry, excludeFromGit, managementRootFor, sharedDomainRegistryFor } from './domains.js'
-import { createRecoveryDriver } from './recovery.js'
-import { createSettlementDriver } from './settle.js'
-import { editLockLimits } from './limits.js'
-import { buildColdView, buildView, unavailableView } from './view.js'
-import { parseSnapshot } from './snapshot.js'
-import { readSnapshotBytes, errorMessage } from './read-authority.js'
-import { registerDelegateEditLifecycle } from '../shared/delegate-edit-lifecycle.js'
-
-const name = 'weir-edit-lock'
-const inject = ['tools', 'fs', 'agents']
-
-/** Tool names whose definitions must be Edit Lock routed when enabled. */
-export const GUARDED_TOOLS = Object.freeze(['write', 'edit', 'hash_edit', 'lsp_rename', 'str_replace_editor'])
-
-/** Claimed managed-editor executions, shared by every mount of this bundle in
- * the process (change edit-lock-shared-domain-mounts, design D3): membership
- * is execute-object identity, so cross-host admission is impossible and an
- * execution claimed by a disposed mount is harmless — no live guard reads it.
- * Whichever mount's guard stage hears an execution, the verdict is the same.
- * @type {WeakSet<Function>} */
-const managed = new WeakSet()
-
-/** Host-lifetime live weirEditLock services (design D3): every mount registers
- * its service at apply and unregisters at dispose, so the endpoint currency
- * proof can accept any live sibling mount's service identity.
- * @type {WeakMap<object, Set<object>>} */
-const liveServicesByHost = new WeakMap()
-/** @param {object} host @returns {Set<object>} */
-function liveServicesFor(host) {
-  let services = liveServicesByHost.get(host)
-  if (!services) {
-    services = new Set()
-    liveServicesByHost.set(host, services)
-  }
-  return services
-}
-
-/** Row config wins over the settings section; `root` + `authorityDirectory`
- * pin one fixed domain (development compositions and probes).
- * @param {unknown} config @param {unknown} [settings] */
-export function editLockOptions(config, settings) {
-  const value = { .../** @type {any} */ (settings ?? {}), .../** @type {any} */ (config ?? {}) }
-  if (value.enabled !== true) return null
-  if (value.root === undefined && value.authorityDirectory === undefined) return { fixed: null }
-  for (const key of ['root', 'authorityDirectory']) {
-    if (typeof value[key] !== 'string' || !isAbsolute(value[key])) throw new Error(`edit lock: ${key} must be an absolute path`)
-  }
-  return { fixed: { root: value.root, directory: value.authorityDirectory } }
-}
-
-/** Never initialize over unknown content: empty → create, committed snapshot → recover.
- * @param {string} directory @returns {'create'|'recover'} */
-export function storeMode(directory) {
-  if (!existsSync(directory)) mkdirSync(directory, { recursive: true, mode: 0o700 })
-  const entries = readdirSync(directory)
-  if (entries.length === 0) return 'create'
-  if (entries.includes('snapshot.json')) return 'recover'
-  throw new Error(`edit lock: authority directory ${directory} has no committed snapshot and is not empty`)
-}
-
-/** @param {any} agent */
-function sessionOf(agent) {
-  return typeof agent?.id === 'string' && agent.id ? agent.id : undefined
-}
-/** Confirm every pending-confirmation lock of one session. Each file goes
- * through the ordinary per-file check, so a file that does not qualify is simply
- * skipped; the bulk path can never widen authority. @param {any} domain
- * @param {any} agent @param {{resourceId: string}[]} pending */
-async function confirmAll(domain, agent, pending) {
-  const confirmed = []
-  for (const lock of pending) {
-    try {
-      await domain.confirm(agent, lock.resourceId)
-      confirmed.push(lock.resourceId)
-    } catch { /* not confirmable any more; the next status shows why */ }
-  }
-  return confirmed
-}
-
-/** Message-driven auto-resume procedure (design D2/D3/D4): the trusted resume
- * runs with a fresh server-minted requestId (never a commandId), then the
- * ordinary per-file confirmation replays over the retained locks — exactly the
- * panel's Continue editing sequence, so it never widens authority. A zero-lock
- * session confirms the empty set. Any failure (a revoked session, a lost race
- * with the manual Continue) only warns; edits stay denied and the panel keeps
- * showing the state. @param {any} domain @param {any} agent
- * @param {(message: string) => void} [warn] */
-async function autoResume(domain, agent, warn) {
-  try {
-    const status = await domain.resume(agent, `auto:user-message:${crypto.randomUUID()}`)
-    const pending = status.locks.filter(/** @param {any} lock */ lock => lock.status === 'pending-confirmation')
-    await confirmAll(domain, agent, pending)
-  } catch (error) {
-    warn?.(`edit lock auto-resume failed: ${/** @type {any} */ (error)?.message ?? error}`)
-  }
-}
-
-/** @param {any} domain @param {any} agent @param {string} raw @param {string} commandId @param {{holdDefaultMinutes: number, holdSingleMaxMinutes: number, holdCumulativeMaxMinutes: number}} limits */
-async function runCommand(domain, agent, raw, commandId, limits) {
-  const [verb, ...rest] = raw.trim().split(/\s+/u)
-  if (!verb || verb === 'status') return describe(await domain.status(agent))
-  if (verb === 'stop') {
-    const status = await domain.stop(agent)
-    return `Edit authority durably revoked for this session.\n${describe(status)}`
-  }
-  if (verb === 'resume') {
-    const status = await domain.resume(agent, `command:${commandId}`)
-    const pending = status.locks.filter(/** @param {any} lock */ lock => lock.status === 'pending-confirmation')
-    // Resume restores authority only; retained files still need an explicit
-    // confirmation (the panel's Continue editing runs resume then confirm --all).
-    return `Edit authority resumed with a new execution epoch.${pending.length ? ` ${pending.length} retained file(s) wait for confirmation: /edit-lock confirm --all, or /edit-lock confirm <path> for one.` : ''}\n${describe(status)}`
-  }
-  if (verb === 'hold') {
-    const minutes = rest.length > 0 && rest[0] !== '' ? Number(rest[0]) : limits.holdDefaultMinutes
-    if (!Number.isFinite(minutes) || minutes <= 0) throw new Error('Usage: /edit-lock hold [minutes]')
-    const held = await domain.hold(agent, Math.round(minutes * 60_000), { singleMaxMs: limits.holdSingleMaxMinutes * 60_000, cumulativeMaxMs: limits.holdCumulativeMaxMinutes * 60_000 })
-    return `Keeping ${held.lockCount} file(s) until ${new Date(held.holdUntil).toLocaleTimeString()} (${Math.round(held.holdCumulativeMs / 60_000)} of ${limits.holdCumulativeMaxMinutes} minutes used in this batch).\n${describe(await domain.status(agent))}`
-  }
-  if (verb === 'confirm') {
-    // `--all` only replays the per-file confirmation over files that already
-    // qualify; it never widens authority (spec: One-step confirmation).
-    if (rest.length === 1 && rest[0] === '--all') {
-      const status = await domain.status(agent)
-      const pending = status.locks.filter(/** @param {any} lock */ lock => lock.status === 'pending-confirmation')
-      const confirmed = await confirmAll(domain, agent, pending)
-      return `Confirmed ${confirmed.length} of ${pending.length} retained file(s).\n${describe(await domain.status(agent))}`
-    }
-    const path = rest.join(' ')
-    if (!path) throw new Error('Usage: /edit-lock confirm <path> | /edit-lock confirm --all')
-    const cwd = agent?.session?.header?.cwd
-    if (typeof cwd !== 'string') throw new Error('session cwd unavailable')
-    const observation = createResourceIdentity().resolve(path, { cwd })
-    if (observation.kind !== 'file') throw new Error('confirm requires an existing regular file')
-    const status = await domain.confirm(agent, observation.resourceId)
-    return `Confirmed ${observation.resourceId}.\n${describe(status)}`
-  }
-  if (verb === 'release') {
-    // Human release of one of this session's own files. It only removes
-    // authority, so it stays available while stopped or recovering.
-    const path = rest.join(' ')
-    if (!path) throw new Error('Usage: /edit-lock release <path>')
-    const cwd = agent?.session?.header?.cwd
-    if (typeof cwd !== 'string') throw new Error('session cwd unavailable')
-    const own = (await domain.status(agent)).locks.find((/** @type {any} */ lock) => lock.resourceId === path)
-    const result = await domain.service.release({ agent }, { filePath: own ? own.resourceId : path, cwd })
-    return `Released ${result.resourceId}.\n${describe(await domain.status(agent))}`
-  }
-  if (verb === 'locks') {
-    const locks = await domain.locks(agent)
-    return locks.length ? locks.map((/** @type {any} */ lock) => `- ${lock.resourceId} owner=${lock.owner} [${lock.status}${lock.reason ? `: ${lock.reason}` : ''}] generation ${lock.generation}`).join('\n') : 'No Edit Lock ownership is held.'
-  }
-  if (verb === 'unlock') {
-    const generation = Number(rest.at(-1))
-    const path = rest.slice(0, -1).join(' ')
-    if (!path || !Number.isSafeInteger(generation)) throw new Error('Usage: /edit-lock unlock <path> <generation> (see /edit-lock locks)')
-    // An exact listed resource id also works for files that no longer exist.
-    let resourceId = (await domain.locks(agent)).find((/** @type {any} */ lock) => lock.resourceId === path)?.resourceId
-    if (!resourceId) {
-      const cwd = agent?.session?.header?.cwd
-      if (typeof cwd !== 'string') throw new Error('session cwd unavailable')
-      const observation = createResourceIdentity().resolve(path, { cwd })
-      if (observation.kind !== 'file') throw new Error('unlock requires an existing regular file or an exact locked resource id')
-      resourceId = observation.resourceId
-    }
-    try {
-      const result = await domain.unlock(agent, resourceId, generation)
-      return `Unlocked ${result.resourceId} (generation ${result.generation}, owner ${result.owner}). Content was not validated.`
-    } catch (error) {
-      // Actionable guidance (recovery UX D4): a fence refusal must name the
-      // resolution path, never leave a bare error code. The guidance is
-      // template-layer copy and stays English per the text discipline.
-      if (/** @type {any} */ (error)?.admissionRefusal === true) {
-        throw Object.assign(new Error(`${/** @type {any} */ (error).message}. Settle it with the administrative recovery in the Edit Lock maintenance panel (Settings → Edit Lock maintenance): it clears the unresolved publication fence and releases the owner's locks in one step.`), { admissionRefusal: true })
-      }
-      throw error
-    }
-  }
-  throw new Error('Usage: /edit-lock [status|locks|hold [minutes]|release <path>|stop|resume|confirm <path>|confirm --all|unlock <path> <generation>]')
-}
-
-/** Ordinary owner tools. Ownership derives from exec.agent, never arguments.
- * @param {any} ctx @param {any} service */
-function registerLockTools(ctx, service) {
-  const filePath = { file_path: { type: 'string', description: 'Existing file path, resolved against the session working directory.' } }
-  /** @param {any} args @param {any} exec */
-  const request = (args, exec) => {
-    if (typeof args?.file_path !== 'string' || !args.file_path.trim()) throw new Error('file_path must be a non-empty string')
-    const cwd = exec.agent?.session?.header?.cwd
-    if (typeof cwd !== 'string') throw new Error('session working directory unavailable')
-    return { filePath: args.file_path, cwd }
-  }
-  const text = (/** @type {string} */ value) => ({ schema: { type: 'object' }, render: (/** @type {any} */ _args, /** @type {any} */ result) => [{ type: 'text', text: result[value] }] })
-  return [
-    ctx.tools.register({
-      name: 'edit_lock_acquire',
-      description: 'Acquire Edit Lock ownership of one existing file before editing it. Edits also acquire implicitly; call this explicitly to reserve a file, and for every file listed as pending-confirmation after a resume. Fails if another session owns the file.',
-      parameters: { type: 'object', properties: filePath, required: ['file_path'] },
-      output: text('message'),
-      async execute(/** @type {any} */ args, /** @type {any} */ exec) {
-        const result = await service.acquire(exec, request(args, exec))
-        return { ...result, message: `Acquired ${result.resourceId} (generation ${result.generation}).` }
-      },
-    }),
-    ctx.tools.register({
-      name: 'edit_lock_release',
-      description: 'Release this session\'s Edit Lock ownership of one file so other sessions can edit it. Release when you are done editing a file. Releasing does not validate the file content.',
-      parameters: { type: 'object', properties: filePath, required: ['file_path'] },
-      output: text('message'),
-      async execute(/** @type {any} */ args, /** @type {any} */ exec) {
-        const result = await service.release(exec, request(args, exec))
-        return { ...result, message: `Released ${result.resourceId}.` }
-      },
-    }),
-    ctx.tools.register({
-      name: 'edit_lock_hold',
-      description: 'Ask to keep this session\'s Edit Lock ownership for a bounded time counted from now, when you still need the files after this turn ends. The maximum per request and the budget for the whole batch are configurable; once the budget is used up you can only release. Keeping a file never grants permission you did not already have, and no file can be kept permanently.',
-      parameters: { type: 'object', properties: {
-        minutes: { type: 'number', description: 'How long to keep the files, counted from now. Omit to use the configured default.' },
-      }, required: [] },
-      output: text('message'),
-      async execute(/** @type {any} */ args, /** @type {any} */ exec) {
-        const minutes = args?.minutes === undefined ? undefined : Number(args.minutes)
-        if (minutes !== undefined && (!Number.isFinite(minutes) || minutes <= 0)) throw new Error('minutes must be a positive number')
-        const result = await service.hold(exec, minutes === undefined ? undefined : Math.round(minutes * 60_000))
-        return { ...result, message: `Keeping ${result.lockCount} file(s) until ${new Date(result.holdUntil).toISOString()}; ${Math.round(result.holdCumulativeMs / 60_000)} of ${result.cumulativeMaxMinutes} minutes used in this batch.` }
-      },
-    }),
-    ctx.tools.register({
-      name: 'edit_lock_try_steal',
-      description: 'Ask the session that owns a file to hand Edit Lock ownership over. Returns a pending request_id immediately; it never waits for the holder. The holder decides at a safe point; no reply within the negotiation window keeps their ownership. You are notified of the outcome; check edit_lock_status.',
-      parameters: { type: 'object', properties: filePath, required: ['file_path'] },
-      output: text('message'),
-      async execute(/** @type {any} */ args, /** @type {any} */ exec) {
-        const result = await service.trySteal(exec, request(args, exec))
-        return { ...result, message: `Request ${result.requestId} is pending with holder ${result.holder} (${result.holderStatus}). Do not edit the file until ownership is granted.` }
-      },
-    }),
-    ctx.tools.register({
-      name: 'edit_lock_pause',
-      description: 'Only during Edit Lock cleanup-only recovery: ask to keep your abnormal locks while an external problem clears (for example a provider outage). Up to 15 minutes per pause and 30 minutes in total; expiry re-checks the situation, it never releases or extends the locks.',
-      parameters: { type: 'object', properties: { minutes: { type: 'number', description: 'Pause length in minutes (at most 15).' } }, required: ['minutes'] },
-      output: text('message'),
-      async execute(/** @type {any} */ args, /** @type {any} */ exec) {
-        const result = await service.pause(exec, Number(args?.minutes))
-        return { ...result, message: `Paused for ${Math.round(result.pausedMs / 60_000)} minute(s); ${Math.round(result.cumulativePauseMs / 60_000)} of 30 cumulative minutes used.` }
-      },
-    }),
-    ctx.tools.register({
-      name: 'edit_lock_status',
-      description: 'List Edit Lock ownership in this work directory: file, owner session, status and reservation. Read-only; grants nothing.',
-      parameters: { type: 'object', properties: {}, required: [] },
-      output: text('message'),
-      async execute(/** @type {any} */ _args, /** @type {any} */ exec) {
-        const unavailable = service.startupFailure(exec.agent)
-        if (unavailable) return { ...unavailable, message: `Edit Lock unavailable: ${unavailable.reason}. ${statusRetryHint(unavailable.bindingFailure)}` }
-        const locks = await service.locks(exec)
-        const lines = locks.map((/** @type {any} */ lock) => `- ${lock.resourceId} owner=${lock.mine ? 'this session' : lock.owner} status=${lock.status} generation=${lock.generation}${lock.reason ? ` reason=${lock.reason}` : ''}`)
-        // The reservation is part of what the holder needs to know: without it the
-        // answer looks identical before and after a successful keep, which invites
-        // asking again instead of carrying on with the work.
-        const retention = await service.retention(exec)
-        if (retention?.held && retention.remainingMs > 0) {
-          lines.push(`Reserved for ${Math.ceil(retention.remainingMs / 60_000)} more minute(s); ${Math.round(retention.holdCumulativeMs / 60_000)} minute(s) used in this batch.`)
-        }
-        return { locks, retention, message: lines.length ? lines.join('\n') : 'No Edit Lock ownership is held.' }
-      },
-    }),
-  ]
-}
-
-/** @param {any} service */
-function replyToolDefinition(service) {
-  return {
-    name: 'edit_lock_reply',
-    description: 'Answer a pending Edit Lock ownership request addressed to this session. decision "release" hands the file to the requester (your ownership ends); "keep" retains it. Only the current holder execution can answer; stale or expired requests are refused.',
-    parameters: { type: 'object', properties: {
-      request_id: { type: 'string', description: 'request_id from the ownership request notice.' },
-      decision: { type: 'string', enum: ['release', 'keep'], description: 'release to hand over, keep to retain.' },
-    }, required: ['request_id', 'decision'] },
-    output: { schema: { type: 'object' }, render: (/** @type {any} */ _args, /** @type {any} */ result) => [{ type: 'text', text: `Request ${result.requestId}: ${result.state}.` }] },
-    async execute(/** @type {any} */ args, /** @type {any} */ exec) {
-      if (typeof args?.request_id !== 'string') throw new Error('request_id must be a string')
-      return service.reply(exec, { requestId: args.request_id, decision: args.decision })
-    },
-  }
-}
-
-/** @param {any} status */
-function describe(status) {
-  const lines = [`Edit Lock session ${status.sessionId}: ${status.state}${status.interrupted ? ' (interrupted)' : ''}, epoch ${status.executionEpoch ?? '-'}`]
-  if (status.revoked) lines.push('Editing authority was revoked by an administrative recovery and its locks were released. Continue editing or send any message to restore editing in a new execution epoch; the revocation record is preserved.')
-  for (const lock of status.locks) lines.push(`- ${lock.resourceId} [${lock.status}${lock.reason ? `: ${lock.reason}` : ''}] generation ${lock.generation}`)
-  if (status.locks.length === 0) lines.push('- no locks held')
-  const recovery = status.recovery
-  if (recovery && (recovery.attempts || recovery.elapsedMs || recovery.pauseMs)) {
-    lines.push(`Recovery: ${recovery.attempts}/3 attempts, ${Math.round(recovery.elapsedMs / 1000)}s of 300s, pause ${Math.round(recovery.pauseMs / 60_000)}/30 min used`)
-  }
-  // Retention is reported as the one thing the user needs from it: how long the
-  // files stay reserved. The raw budget belongs to the structured view, not here.
-  const retention = status.retention
-  if (retention?.held && retention.remainingMs > 0) {
-    lines.push(`Reserved for ${Math.ceil(retention.remainingMs / 60_000)} more minute(s); ${Math.round(retention.holdCumulativeMs / 60_000)} minute(s) used in this batch.`)
-  }
-  return lines.join('\n')
-}
-
-// The binding-failure notice copy moved with the binding state machine to
-// binding-machine.js (change edit-lock-deepening, design D3) — it renders only
-// inside setupAgentOnce's failure record.
-
-/** Read-only binding-unavailable guidance tail for the tool/service surfaces
- * (domainFor and edit_lock_status), split by the recorded holder class.
- * @param {string} failure @param {any} bindingFailure */
-function bindingUnavailableMessage(failure, bindingFailure) {
-  const kind = bindingFailure?.holderKind
-  if (kind === 'transferable') return `Edit Lock binding is unavailable (${failure}). The holder is an inactive attachment of this same session: the binding transfers automatically when the user next sends a message, and /edit-lock retry also takes it over; neither resumes editing by itself. Do not retry the failed edit.`
-  if (kind === 'serving') return `Edit Lock binding is unavailable (${failure}). This session is being edited in another attachment right now; retry the connection once that turn finishes. Do not retry the failed edit.`
-  return `Edit Lock binding is unavailable (${failure}). Do not retry the failed edit: the binding is retried automatically when the user next sends a message, after which editing works normally. Never remove a live publisher reservation.`
-}
-
-/** edit_lock_status read-only guidance tail, split by the recorded holder
- * class (change edit-lock-binding-transfer). @param {any} bindingFailure */
-function statusRetryHint(bindingFailure) {
-  if (bindingFailure?.retryable !== true) return 'Inspect Edit Lock maintenance before continuing.'
-  if (bindingFailure.holderKind === 'transferable') return 'The holder is an inactive attachment of this same session: editing attaches automatically when you next send a message, and /edit-lock retry also takes it over; neither resumes editing by itself.'
-  if (bindingFailure.holderKind === 'serving') return 'This session is being edited in another attachment right now; /edit-lock retry retries the connection once that turn finishes — it does not resume editing by itself.'
-  return 'Do not retry failed edits: the binding is retried automatically when the user next sends a message, and /edit-lock retry also retries the connection; neither resumes editing by itself.'
-}
-
-/** Composition dependencies, not persisted settings. Defaults are the host paths.
- * @param {{ platform?: string, resolveRoot?: typeof managementRootFor, endpoint?: typeof endpointFor, exclude?: typeof excludeFromGit }} [dependencies] */
-export function createEditLockPlugin({ platform = process.platform, resolveRoot = managementRootFor, endpoint = endpointFor, exclude = excludeFromGit } = {}) {
-/** Arrow on purpose: cordis constructs prototype-bearing callbacks with `new`
- * and then drops their returned disposer, which would leak the reservation.
- * @param {any} ctx @param {unknown} config */
-return (ctx, config = {}) => {
-  const settings = ctx.get?.('weirSettings')
-  const options = editLockOptions(config, settings?.get?.('editLock'))
-  // A generation-owned reporter; a later mount cannot overwrite this row.
-  const evidence = settings?.editLockEvidence?.recordMount?.({
-    enabled: Boolean(options), pinned: Object.hasOwn(config ?? {}, 'enabled'),
-    fixed: options?.fixed != null, phase: options ? 'installing' : 'installed',
-  })
-  if (!options) return evidence ? () => evidence.dispose() : undefined
-  // Resource identity is the narrowest supported envelope (Darwin/Linux/Win32;
-  // each has a local endpoint). Its factory performs no filesystem operations.
-  // Keep the provider mounted on failure: absence would select unlocked editors.
-  // This mount-time decision never follows a later saved-off setting.
-  let platformFailure = null
-  try { createResourceIdentity({ platform }) } catch (error) {
-    platformFailure = Object.assign(new Error(`Edit Lock ${errorMessage(error)}; managed editing is unavailable. Supported platforms: darwin, linux, win32.`), { code: 'weir-edit-lock/unsupported-platform' })
-    evidence?.failed(platformFailure)
-    ctx.logger?.warn?.(platformFailure.message)
-  }
-  /** The shared-registry handle, assigned inside the mount try so a failed
-   * apply can release its count (design D1: a failed mount enters no count).
-   * @type {any} */
-  let shared = null
-  try {
-  /** @type {any} */
-  let sandboxPolicyRef = null
-  ctx.inject?.(['sandboxPolicy'], (/** @type {any} */ scope) => { sandboxPolicyRef = scope.sandboxPolicy })
-  // Capture the original host filesystem once; the manager is its only writer.
-  const fs = ctx.fs
-  const audit = createAudit(ctx)
-  // The host-lifetime key shared by the write-scope store, the domain registry
-  // container and the live-service set (design D1/D3) — identical to the key
-  // expression the settings evidence store uses.
-  const host = ctx.root ?? ctx
-  const liveServices = liveServicesFor(host)
-  /** Successful undefined means no live runtime; missing service means unknown.
-   * @param {string} sessionId */
-  const servingRuntime = sessionId => {
-    const agents = ctx.get?.('agents')
-    if (typeof agents?.get !== 'function') throw new Error('agent registry unavailable')
-    return agents.get(sessionId)
-  }
-  const attestBinding = createBindingAttester(servingRuntime)
-  /** Detached stale-lock sweeps, coalesced per management-domain ROOT with a
-   * single in-flight sweep and a 60s cooldown (see stale-sweep.js). */
-  const sweeps = createStaleSweepScheduler({
-    warn: message => ctx.logger?.warn?.(message),
-    setTimer: fn => (safeSetTimer(ctx) ?? globalThis.setTimeout)(fn, 0),
-  })
-  // The binding state machine's stores (disposedAgents, startFailures,
-  // bindingFailures, setupInFlight, boundAgents, dispositions,
-  // agentDispositions) live in binding-machine.js and arrive destructured
-  // below (change edit-lock-deepening, design D3).
-  /** One queued automatic-recovery summary notice per management root (design
-   * D3): delivered to the first agent that finishes domain start, then gone.
-   * Shared across sibling mounts with the domain registry (change
-   * edit-lock-shared-domain-mounts): the domain opens through the first
-   * mount's closure, so the queue must live in the shared entry for the
-   * mount that hears the first post-recovery turn to drain it. Assigned
-   * with `shared` below. @type {Map<string, string>} */
-  let recoveryNotices
-  /** Managed write registrations outlive this mount: the tool is installed
-   * into the agent's OWN scope layer, which a preset rebind never disposes.
-   * Their disposers live in a host-lifetime store so any later generation can
-   * retire the stale layer before re-installing (design D3); entries are
-   * released at agent/disposed. Unmount deliberately leaves them in place —
-   * tearing the managed write down mid-gap would expose the stock writers
-   * until the next mount's per-agent re-install.
-   * @type {WeakMap<object, import('./write-scopes.js').WriteScopeEntry>} */
-  const writeScopes = writeScopesFor(host)
-  let closed = false
-  /** Remote channel agents on the publisher side → their notice sink.
-   * @type {WeakMap<object, (event: unknown) => void>} */
-  const sinks = new WeakMap()
-  /** Settled domain per bound agent, for synchronous gates. Shared across
-   * sibling mounts with the domain registry (design D3): whichever mount
-   * hears an event reads the same binding. Assigned with `shared` below.
-   * @type {WeakMap<object, any>} */
-  let settled
-  /** `wake` is used only for an ownership request addressed to an idle holder:
-   * inject alone would sit unread until the holder's next user message, which is
-   * how a request expired unanswered. Interrupted holders are never woken.
-   * @param {any} agent @param {string} text @param {boolean} [wake] */
-  const deliverLocal = (agent, text, wake = false) => {
-    const message = userTextMessage(text, 'weir-edit-lock')
-    if (wake && agent?.status === 'idle' && agent?.followup) agent.followup(message)
-    else agent.inject(message)
-  }
-  /** @param {any} agent @param {any} event */
-  function deliverEvent(agent, event) {
-    if (event?.kind === 'notice' && typeof event.text === 'string') deliverLocal(agent, event.text, event.wake === true)
-    if (event?.kind === 'pending' && Number.isSafeInteger(event.count)) syncReplyTool(agent, event.count)
-  }
-
-  /** @param {string} root @param {string} directory
-   * @param {string} [noticeKey] registry key agents are bound to (differs from
-   * `root` in fixed-domain compositions: the registry key is the resolved
-   * management root of the session cwd) */
-  async function openDomain(root, directory, noticeKey = root) {
-    try {
-      if (!existsSync(directory)) mkdirSync(directory, { recursive: true, mode: 0o700 })
-      let runtime
-      try {
-        // The store mode is read only after the reservation is held.
-        runtime = await openReservedEditLockRuntime({ root, directory, domainId: root, mode: () => storeMode(directory), fs })
-        // Dead-process unknowns settled in the recovery commit (design D3):
-        // one shared audit per recovery, and at most one summary notice
-        // queued for the first agent that starts a turn in this domain.
-        const settledRecovery = runtime.automaticRecovery
-        if (settledRecovery?.records?.length) {
-          const settledOperations = settledRecovery.records.reduce((count, record) => count + record.operations.length, 0)
-          audit(null, AUDIT_TYPES.editLockMaintenance, {
-            kind: 'automatic-recovery', root, revision: settledRecovery.revision,
-            owners: settledRecovery.records.map(record => record.owner),
-            recoveryIds: settledRecovery.records.map(record => record.recoveryId),
-            operations: settledOperations,
-          }, { root })
-          recoveryNotices.set(noticeKey, `Edit Lock: ${settledOperations} unresolved publication(s) left behind by a previous, crashed process were settled automatically while opening this workspace. Their outcomes stay unknown in history; the blocked files are editable again. Details are in the administrative ledger and the maintenance audit.`)
-        }
-      } catch (error) {
-        if (/** @type {any} */ (error)?.code !== 'EEXIST') throw error
-        // Another cooperating host publishes: become its client, never a writer.
-        const domain = remoteDomain(createRemoteEditLockDomain(endpoint(directory), {
-          onNotice: deliverEvent,
-          onChannelOpen: registerBindingRuntime,
-          // The only way to reach here without a live publisher is a reservation left
-          // by a host that crashed or was killed. Say so, and say what clears it.
-          unreachableHint: `Another DeepSeek Harness reserved this project but is not answering. If no other Harness window is open on it, quit DeepSeek Harness, remove ${reservationPathFor(directory)}, and start it again.`,
-        }))
-        try { evidence?.recordDomain?.(root, { mode: domain.mode }) } catch { /* reporting only */ }
-        return domain
-      }
-      const lifecycle = createEditLockLifecycle(runtime, sessionOf, {
-        servingRuntime,
-        // Bounded failure logging for the sweep: one warning per failed row
-        // (skips stay quiet), routed to the host logger.
-        warn: message => ctx.logger?.warn?.(message),
-        deliver: (agent, text, wake) => { const sink = sinks.get(agent); if (sink) sink({ kind: 'notice', text, wake: wake === true }); else deliverLocal(agent, text, wake) },
-        onPending: (agent, count) => { const sink = sinks.get(agent); if (sink) sink({ kind: 'pending', count }); else syncReplyTool(agent, count) },
-        // Stale-lock sweep audit: publisher-side, after each durable release;
-        // the JSONL mirror anchors at the management root. Never a session
-        // event, never a conversation write (AGENTS §3.6).
-        onStaleRelease: (row, triggerSessionId) => audit(null, AUDIT_TYPES.editLockMaintenance, {
-          kind: 'stale-sweep', root, trigger: triggerSessionId ?? null, owner: row.owner, resourceId: row.resourceId, generation: row.generation,
-        }, { root }),
-        // Online administrative recovery audit (design D4): publisher-side,
-        // after the durable commit; the trigger session comes from the
-        // channel/local settings plane, never from the request payload.
-        onAdminRecovery: info => audit(null, AUDIT_TYPES.editLockMaintenance, {
-          kind: 'admin-override-online', root, trigger: info.trigger ?? null, owner: info.record.owner,
-          recoveryId: info.record.recoveryId, revision: info.revision, idempotent: info.idempotent,
-          operations: info.record.operations.length,
-        }, { root }),
-        // Revocation repair audit: publisher-side, after the durable resume
-        // commit advanced the owner's epoch past its revokedEpoch. The ledger
-        // record itself never changes; the repair is a new-epoch event.
-        onRevocationRepair: info => audit(null, AUDIT_TYPES.editLockMaintenance, {
-          kind: 'revocation-repaired', root, owner: info.owner, trigger: info.trigger,
-          fromEpoch: info.fromEpoch ?? null, toEpoch: info.toEpoch,
-        }, { root })
-      })
-      let server
-      try { server = await serveEditLockEndpoint(lifecycle, endpoint(directory), sinks, attestBinding,
-        (agent, requireProof, transfer = false) => {
-          if (closed || disposedAgents.has(agent)) return false
-          const agents = ctx.get?.('agents')
-          if (typeof agents?.get === 'function') {
-            if (transfer === true) {
-              // A transfer claimant is NEVER the registry's serving agent —
-              // that mismatch is the defect being repaired (change
-              // edit-lock-binding-transfer). Its liveness proof is listing
-              // among the live root agents; holder-side admission is the
-              // lifecycle's transferStart.
-              if (typeof agents.roots !== 'function' || !agents.roots().includes(agent)) return false
-            } else if (agents.get(agent.id) !== agent) return false
-          } else if (requireProof) return false
-          // Fresh creation keeps the established missing/throwing-registry
-          // fallback. A reclaim or retry never uses that fallback as proof.
-          // Currency proof (design D3): the agent's resolved service must be a
-          // LIVE service of this process — after a preset switch that is the
-          // sibling mount's service, never this mount's own necessarily.
-          if (typeof presets?.serviceFor === 'function') {
-            try { return liveServices.has(presets.serviceFor(agent, 'weirEditLock')) }
-            catch { return !requireProof }
-          }
-          return true
-        }) }
-      catch (error) { ctx.logger?.warn?.(`edit lock endpoint unavailable; other hosts fail closed: ${/** @type {any} */ (error)?.message ?? error}`) }
-      const domain = localDomain(lifecycle, server)
-      try { evidence?.recordDomain?.(root, { mode: domain.mode, bindings: () => [...lifecycle.bindings(), ...(server?.bindings() ?? [])] }) } catch { /* reporting only */ }
-      return domain
-    } catch (error) {
-      // A domain that never opened is maintenance-visible as initialization
-      // blocked; the manager behavior is unchanged.
-      try { evidence?.recordDomain?.(root, { error: String(/** @type {any} */ (error)?.message ?? error) }) } catch { /* reporting only */ }
-      throw error
-    }
-  }
-  // One domain registry per host + effective domain configuration, shared by
-  // every same-process preset mount of this bundle (design D1): a sibling
-  // mount never degrades to a same-process remote client, and the LAST
-  // disposer closes all domains through the established drain discipline. The
-  // first mount's `open` closure serves every sharing mount — mounts are
-  // process-persistent, so the capture is safe (design D1 trade-off).
-  shared = sharedDomainRegistryFor(host, options.fixed ? `${options.fixed.root}\n${options.fixed.directory}` : '', () => createDomainRegistry(root => {
-    const fixed = options.fixed
-    if (fixed) return openDomain(fixed.root, fixed.directory, root)
-    try { exclude(root) } catch (error) { ctx.logger?.warn?.(`edit lock: could not update .git/info/exclude: ${/** @type {any} */ (error)?.message ?? error}`) }
-    return openDomain(root, join(root, AUTHORITY_DIR), root)
-  }, resolveRoot))
-  const registry = shared.registry
-  settled = shared.settled
-  recoveryNotices = shared.recoveryNotices
-  /** @param {any} agent */
-  const domainOf = agent => registry.forAgent(agent)
-  /** Lazy re-bind (design D2): an own-preset main agent with no binding —
-   * orphaned by a preset switch in the blank window — gets ONE idempotent
-   * re-setup through the standard path before the call is refused. A recorded
-   * failure suppresses retries for the rest of this mount generation, and
-   * foreign-preset agents are never tried (the own-preset fence is unchanged).
-   * `ownAgent`/`setupAgent` are declared below and only dereferenced when a
-   * call actually arrives. @param {any} agent */
-  async function domainFor(agent) {
-    if (platformFailure) throw platformFailure
-    if (!registry.rootOf(agent) && !closed && !startFailures.has(agent) && (agent?.session?.header?.delegationDepth ?? 0) === 0 && ownAgent(agent)) await setupAgent(agent)
-    await setupInFlight.get(agent)
-    if (settled.has(agent)) return settled.get(agent)
-    const failure = startFailures.get(agent)
-    if (failure && bindingFailures.has(agent)) throw new Error(bindingUnavailableMessage(failure, bindingFailures.get(agent)))
-    if (failure) throw new Error(`this session has no Edit Lock domain: setup failed under the current preset generation (${failure}); the automatic re-bind was already attempted. Recovery: restart DeepSeek Harness or start a new conversation.`)
-    // No fence match (foreign preset) or unmount: keep the stock refusal.
-    return registry.forAgent(agent)
-  }
-
-  /** The holder's structured reply tool. It is registered on the first request
-   * and retired at a turn boundary once no request is pending: unregistering it
-   * mid-turn made an expired-but-retried reply report "unknown tool" instead of
-   * the real reason.
-   * @type {WeakMap<object, {dispose: () => void, stale: boolean}>} */
-  const replyTools = new WeakMap()
-  /** @param {any} agent @param {number} pending */
-  function syncReplyTool(agent, pending) {
-    const registered = replyTools.get(agent)
-    if (pending > 0 && !registered && agent?.ctx?.tools?.register) {
-      replyTools.set(agent, { dispose: agent.ctx.tools.register(replyToolDefinition(service)), stale: false })
-    } else if (registered) {
-      registered.stale = pending === 0
-    }
-  }
-  /** @param {any} agent */
-  function retireReplyTool(agent) {
-    const registered = replyTools.get(agent)
-    if (!registered?.stale) return
-    replyTools.delete(agent)
-    registered.dispose()
-  }
-  /** @param {string} method */
-  const route = method => async (/** @type {any} */ exec, /** @type {any} */ request) => /** @type {any} */ ((await domainFor(exec.agent)).service)[method](exec, request)
-  const recovery = createRecoveryDriver({
-    domainFor: agent => settled.get(agent),
-    followup: (agent, text) => { if (!disposedAgents.has(agent)) /** @type {any} */ (agent).followup(userTextMessage(text, 'weir-edit-lock-recovery')) },
-    notify: deliverLocal,
-    warn: message => ctx.logger?.warn?.(message),
-  })
-  /** Retention policy is resolved once per read from the settings section, so a
-   * committed change takes effect without a restart and the kernel stays free of
-   * configuration. @returns {any} */
-  const strictLimits = () => editLockLimits(ctx.get?.('weirSettings')?.get?.('editLock'))
-  /** An incoherent saved combination (each field is validated on its own, so e.g.
-   * a single cap below the default can be saved) must never switch off settling,
-   * status, release, stop or unlock. Those read the built-in defaults instead and
-   * warn; only a retention request is refused, with the named reason, because
-   * that is the one decision the bad setting is about. */
-  let warnedLimits = ''
-  const limits = () => {
-    try { return strictLimits() } catch (error) {
-      const message = String(/** @type {any} */ (error)?.message ?? error)
-      if (warnedLimits !== message) { warnedLimits = message; ctx.logger?.warn?.(`edit lock settings ignored, using defaults: ${message}`) }
-      // Fall back for the retention fields only. The notice count and the
-      // disposition keep their saved values: a bad cap must never turn a team's
-      // "flag for a human" choice into a silent release.
-      const section = /** @type {any} */ (ctx.get?.('weirSettings')?.get?.('editLock')) ?? {}
-      let nudge
-      try { nudge = editLockLimits({ nudgeAttempts: section.nudgeAttempts, nudgeFallback: section.nudgeFallback }) } catch { nudge = editLockLimits(undefined) }
-      return { ...editLockLimits(undefined), nudgeAttempts: nudge.nudgeAttempts, nudgeFallback: nudge.nudgeFallback, holdUnavailable: true }
-    }
-  }
-  /** Turn-end settling: a finished turn that left locks behind is continued once,
-   * asking for each file to be released or kept explicitly (design D2/D3). Only
-   * `completed` enters here; the error and stop paths keep their own handling. */
-  const settle = createSettlementDriver({
-    domainFor: agent => settled.get(agent),
-    followup: (agent, text) => { if (!disposedAgents.has(agent)) /** @type {any} */ (agent).followup(userTextMessage(text, 'weir-edit-lock-settle')) },
-    notify: deliverLocal,
-    limits,
-    warn: message => ctx.logger?.warn?.(message),
-  })
-  /** Expiry timers, keyed per agent. Read-time settlement is authoritative, so a
-   * lost timer (suspend, sleep) only delays the release, never the decision.
-   * @type {WeakMap<object, {timer?: any}>} */
-  const expiry = new WeakMap()
-  /** A genuine user message asked for the stopped session's automatic resume.
-   * Boolean, consumed once by the next turn's first pre-step (message-driven
-   * auto-resume D1/D6); WeakMap keys die with their agent. @type {WeakMap<object, boolean>} */
-  const pendingAutoResume = new WeakMap()
-  const delegateResumes = new Map()
-  const turnClassifications = new WeakMap()
-  // The per-agent binding state machine (change edit-lock-deepening, design
-  // D3): setup/retry/dispose/startup-diagnostic plus the binding stores,
-  // shared by every entry point below. The remaining wiring reads the same
-  // container objects through these destructured aliases.
-  const {
-    disposedAgents, startFailures, bindingFailures, setupInFlight,
-    boundAgents, dispositions, agentDispositions,
-    setupAgent, retryBinding, disposeAgent, startupFailure,
-  } = createBindingMachine({
-    ctx, sessionOf, GUARDED_TOOLS, options, registry, settled, writeScopes,
-    domainOf, servingRuntime,
-    // Late-bound wiring (ownAgent and the service object are declared below;
-    // the machine dereferences them only when an entry point actually calls).
-    ownAgent: (/** @type {any} */ agent) => ownAgent(agent),
-    installWriteScope: (/** @type {any} */ agent) => ({ owner: service, dispose: installEditLockWriteScope(agent, ctx, service, sandboxPolicyRef) }),
-    evidence, audit, deliverLocal,
-    pendingAutoResume, delegateResumes, turnClassifications, replyTools, expiry, settle,
-    isClosed: () => closed, platformFailure: () => platformFailure,
-  })
-  /** @param {any} agent @param {any} domain */
-  function armExpiry(agent, domain) {
-    const state = expiry.get(agent) ?? {}
-    expiry.set(agent, state)
-    if (state.timer) clearTimeout(state.timer)
-    state.timer = undefined
-    // Awaited: a cross-process client answers retention asynchronously, and a
-    // synchronous read there never armed the timer at all.
-    void Promise.resolve(domain.retention?.(agent)).then(retention => {
-      if (!retention?.held || !(retention.remainingMs > 0)) return
-      // Read the host timer through a guarded probe, not a bare member access: an
-      // unavailable cordis service throws on access rather than returning undefined.
-      const setTimer = safeSetTimer(ctx) ?? globalThis.setTimeout
-      state.timer = setTimer(() => {
-        state.timer = undefined
-        // Busy at expiry: the turn-end handler releases it once that turn ends.
-        void Promise.resolve(domain.settleExpired(agent)).then(result => {
-          if (!result?.released?.length) return
-          settle.settled(agent)
-          deliverLocal(agent, `Edit Lock: the reservation ended, so ${result.released.length} file(s) are available to other sessions.`)
-        }).catch((/** @type {any} */ error) => ctx.logger?.warn?.(`edit lock expiry release failed: ${error?.message ?? error}`))
-      }, Math.min(retention.remainingMs, 2 ** 31 - 1))
-      state.timer?.unref?.()
-    }).catch((/** @type {any} */ error) => ctx.logger?.warn?.(`edit lock expiry arm failed: ${error?.message ?? error}`))
-  }
-  const service = Object.freeze({
-    startupFailure,
-    publish: route('publish'),
-    publishBatch: route('publishBatch'),
-    acquire: route('acquire'),
-    release: route('release'),
-    /** @param {any} exec */
-    async locks(exec) { return (await domainFor(exec.agent)).service.locks(exec) },
-    trySteal: route('trySteal'),
-    reply: route('reply'),
-    /** @param {any} exec @param {number} minutes */
-    pause(exec, minutes) { return recovery.pause(exec.agent, minutes) },
-    /** Ask to keep this session's locks after the turn ends, for a bounded time.
-     * Retention only extends ownership; it grants nothing new (spec: Explicit
-     * bounded retention). @param {any} exec @param {number} ms */
-    async hold(exec, ms) {
-      const policy = strictLimits()
-      if (ms === undefined) ms = Math.round(policy.holdDefaultMinutes * 60_000)
-      const result = await (await domainFor(exec.agent)).hold(exec.agent, ms, {
-        singleMaxMs: policy.holdSingleMaxMinutes * 60_000,
-        cumulativeMaxMs: policy.holdCumulativeMaxMinutes * 60_000,
-      })
-      armExpiry(exec.agent, settled.get(exec.agent))
-      return { ...result, cumulativeMaxMinutes: policy.holdCumulativeMaxMinutes }
-    },
-    /** Retention state for this session, settled against now. Resolved through the
-     * domain registry — the same path the lock list takes — rather than through the
-     * per-agent binding, so a read-only observation works from any tool context.
-     * @param {any} exec */
-    async retention(exec) {
-      const domain = await domainFor(exec.agent)
-      return domain.retention(exec.agent)
-    },
-    /** Mount-time handshake from a managed editor. @param {object} definition */
-    claim(definition) {
-      const execute = /** @type {any} */ (definition)?.execute
-      if (typeof execute === 'function') managed.add(execute)
-    },
-    /** Continuation gate: an interrupted or recovering session is never
-     * re-armed implicitly. Unknown/unavailable state also blocks. @param {any} agent */
-    blocksContinuation(agent) {
-      const domain = settled.get(agent)
-      return !domain || domain.blocks(agent)
-    },
-    /** Trusted UI observation for one agent; grants nothing. @param {any} agent */
-    async describe(agent) {
-      const failure = startupFailure(agent)
-      if (failure) throw Object.assign(new Error(failure.reason), { bindingFailure: failure.bindingFailure })
-      const domain = await domainFor(agent)
-      return { root: registry.rootOf(agent), mode: domain.mode, status: await domain.status(agent), locks: await domain.locks(agent), recovery: recovery.state(agent) }
-    },
-  })
-  ctx.reflect.provide('weirEditLock', service)
-  // Any live sibling mount's service identity attests endpoint currency
-  // (design D3); unregister at dispose.
-  liveServices.add(service)
-
-  const offTools = registerLockTools(ctx, service)
-
-  ctx.on('tools/pre-execute', async (/** @type {any} */ exec, /** @type {() => Promise<any>} */ next) => {
-    if (!GUARDED_TOOLS.includes(exec?.name)) return next()
-    if (platformFailure) return { kind: 'deny', reason: platformFailure.message, info: { name: 'EditLockPlatformError', code: platformFailure.code } }
-    const admitted = () => {
-      const definition = ctx.tools.get(exec.name, exec.agent)
-      return typeof definition?.execute === 'function' && managed.has(definition.execute)
-    }
-    if (admitted()) return next()
-    // Lazy re-bind fallback (design D2): an own-preset agent whose binding was
-    // orphaned by a blank-window preset switch gets ONE idempotent re-setup
-    // before denial. A recorded failure suppresses further retries for the
-    // rest of this mount generation; foreign agents are never tried.
-    const agent = exec?.agent
-    if (!closed && agent && !registry.rootOf(agent) && !startFailures.has(agent) && (agent?.session?.header?.delegationDepth ?? 0) === 0 && ownAgent(agent)) {
-      await setupAgent(agent)
-      // The lazy re-bind is a driving ingress (design D1, change
-      // edit-lock-binding-transfer): when the re-setup just recorded a
-      // duplicate-binding failure, ONE transfer-capable retry runs here — an
-      // idle same-process holder hands the binding over mid-turn. The recorded
-      // failure then suppresses further attempts for the rest of this mount
-      // generation, so arbitrary write calls never loop retries.
-      if (bindingFailures.get(agent)?.code === 'binding-duplicate') {
-        try { await retryBinding(agent, 'write-guard') } catch { /* audited inside retryBinding; the denial below names the recorded cause */ }
-      }
-      if (admitted()) return next()
-    }
-    const failure = /** @type {any} */ (agent) ? startFailures.get(agent) : undefined
-    if (failure) return { kind: 'deny', reason: `${exec.name} refused: this session has no Edit Lock domain under the current preset generation (setup failed: ${failure}); an automatic re-bind was attempted and did not recover it. Recovery: restart DeepSeek Harness or start a new conversation.` }
-    return { kind: 'deny', reason: `${exec.name} is not routed through Edit Lock in this composition; unmanaged file mutation refused.` }
-  })
-  // The binding stores (boundAgents, dispositions, agentDispositions) and
-  // dispositionFor moved into binding-machine.js; delegateResumes and
-  // turnClassifications stay composition-owned and are declared above with it.
-  // setupAgentOnce / setupAgent / retryBinding moved into binding-machine.js
-  // (change edit-lock-deepening, design D3) — they arrive destructured above.
-  ctx.on('agent/created', (/** @type {any} */ { agent }) => setupAgent(agent))
-
-  // Late-mount catch-up (the same mount-order hazard the worktree-mode guard
-  // documents): after an application restart the preset mounts FOR the first
-  // session's main agent, so that agent's agent/created event is already past
-  // and the listener above never sees it. Bind every existing root agent now,
-  // through the identical setup; sub-agents are always created after mount and
-  // need no catch-up. Failures are recorded and surfaced exactly like
-  // creation-time ones, because it is the same code path.
-  //
-  // Cross-preset fence: the creation listener only ever hears agents whose
-  // event bubbles through THIS preset mount, but agents.roots() is a
-  // process-wide registry — a foreign agent bound here would get its edit
-  // tools denied (and a denial against a foreign tool catalog used to escape
-  // as a host-fatal error). Identity-compare the weirEditLock instance the
-  // agent's own retained preset mount resolves: only an agent of THIS mount
-  // sees this exact service object. Without a preset registry (host-level
-  // compositions, e.g. the integration harness) every root is eligible.
-  const presets = /** @type {any} */ (ctx.get?.('agentPresets'))
-  const ownAgent = typeof presets?.serviceFor === 'function'
-    ? (/** @type {any} */ agent) => {
-      try { return presets.serviceFor(agent, 'weirEditLock') === service } catch { return false }
-    }
-    : () => true
-  const offDelegateLifecycle = registerDelegateEditLifecycle({
-    owns: ownAgent,
-    async resume(childId) {
-      const requestId = `supervised-resume:${crypto.randomUUID()}`
-      if (delegateResumes.has(childId)) throw new Error('supervised resume already in progress')
-      const resumed = new Map()
-      const pending = new Set()
-      let failure
-      const intent = {
-        resume(agent, domain) {
-          const task = (async () => {
-            if (!domain.blocks(agent)) return
-            await domain.resume(agent, requestId)
-            resumed.set(agent, domain)
-          })()
-          pending.add(task)
-          return task.catch(error => { failure = error; throw error })
-        },
-      }
-      delegateResumes.set(childId, intent)
-      const finish = async delivered => {
-        delegateResumes.delete(childId)
-        await Promise.allSettled(pending)
-        // Failed delivery must not leave authority armed, including a child
-        // activated inside sendMessage. Stop uses the existing epoch fence.
-        if (!delivered || failure) {
-          await Promise.all([...resumed].map(([agent, domain]) => domain.stop(agent)))
-        }
-        if (failure) throw failure
-      }
-      try {
-        const agent = boundAgents.get(childId)
-        const domain = agent && settled.get(agent)
-        if (domain) await intent.resume(agent, domain)
-      } catch (error) { await finish(false); throw error }
-      return finish
-    },
-    async settle(childId, agent) {
-      const record = agent ? agentDispositions.get(agent) : dispositions.get(childId)
-      await record?.promise
-    },
-  })
-  const endedRuns = new Set()
-  ctx.on('subagent/end', ({ id, runId, stopReason }) => {
-    // id is the exact child SessionId, not runId. Only published terminal
-    // outcomes enter here; ordinary continuable turn ends do not dispose.
-    if (!['completed', 'aborted', 'error', 'max-tokens', 'refusal'].includes(stopReason)) return
-    if (runId && endedRuns.has(runId)) return
-    if (runId) endedRuns.add(runId)
-    const agent = boundAgents.get(id)
-    if (agent) return disposeAgent(agent).catch(error => ctx.logger?.warn?.(`edit lock delegate settlement failed: ${error?.message ?? error}`))
-  })
-  try {
-    for (const agent of ctx.get?.('agents')?.roots?.() ?? []) {
-      if ((agent?.session?.header?.delegationDepth ?? 0) !== 0) continue
-      if (!ownAgent(agent)) continue
-      void setupAgent(agent)
-    }
-  } catch {
-    // No agent registry in this composition: only the creation path binds.
-  }
-
-  // Preset-switch re-binding (design D1): select → recompose rebinds the
-  // agent's scope chain to the new generation WITHOUT re-emitting
-  // agent/created; the preset registry re-emits this session event unscoped
-  // (dsh-agent-preset-registry: ctx.emit('agent-preset/selected', session.id,
-  // agentPreset)) AFTER the rebind has landed, so a re-setup here binds under
-  // THIS generation. The listener must return undefined (serial-bail
-  // discipline). A switch to a foreign preset fails the ownAgent fence and
-  // stays hard-refused, exactly as before; a setup failure lands in the
-  // fourfold record and the guard's lazy path does not retry it this
-  // generation.
-  ctx.on('agent-preset/selected', (/** @type {any} */ sessionId) => {
-    if (closed) return
-    const agent = typeof sessionId === 'string' ? ctx.get?.('agents')?.get?.(sessionId) : undefined
-    if (!agent || !ownAgent(agent)) return
-    void setupAgent(agent)
-  })
-
-  // Stock Stop aborts the active turn signal synchronously: close admission at
-  // that instant. Idle Stop has no signal; /edit-lock stop is the awaitable path.
-  /** Turn identity seen last per agent, so a new turn is detected exactly once.
-   * @type {WeakMap<object, unknown>} */
-  const lastTurn = new WeakMap()
-  // pendingAutoResume moved next to the binding machine (its retry path clears
-  // an armed auto-resume); it is declared above with it.
-  /** A genuine user message also arms ONE bounded binding retry when this agent
-   * has a recorded duplicate-binding failure (message-driven self-heal, design
-   * D5): consumed at the next turn's first pre-step by awaiting the existing
-   * trusted retryBinding — same attestation guards, same in-flight join,
-   * fail-closed while a holder serves. @type {WeakMap<object, boolean>} */
-  const pendingBindingRetry = new WeakMap()
-  /** @type {WeakSet<AbortSignal>} */
-  const watched = new WeakSet()
-  ctx.on('agent/pre-step', async (/** @type {any} */ event, /** @type {() => Promise<any>} */ next) => {
-    const { agent, signal, turn } = event ?? {}
-    // `pre-step` fires once per STEP, not per turn, so "a new turn started" has to
-    // be detected on turn identity. Doing it on every step would clear the
-    // reservation a holder just asked for, one step later. The detection runs
-    // even without a settled domain: a message-armed binding retry (D5) exists
-    // exactly while no domain is settled and must precede the turn's first step.
-    if (agent && turn && lastTurn.get(agent) !== turn) {
-      lastTurn.set(agent, turn)
-      if (pendingBindingRetry.get(agent) === true) {
-        pendingBindingRetry.delete(agent)
-        try {
-          await retryBinding(agent, 'message')
-          // The genuine message that armed this retry is also this turn's
-          // Continue receipt: re-arm what setupAgentOnce(retry) cleared, then
-          // fall through to the ordinary auto-resume consumption below. A
-          // transfer success (registry named an idle same-process holder)
-          // lands here identically: bound interrupted, then resumed in-turn.
-          pendingAutoResume.set(agent, true)
-          // The outcome audit (transferred / refused) was written inside
-          // retryBinding — success AND refusal alike; the catch below is not
-          // a silent swallow any more (design D3).
-        } catch { /* a safe refusal keeps the recorded cause; the turn proceeds with edits denied */ }
-      }
-      const domain = settled.get(agent)
-      if (domain) {
-        // A queued automatic-recovery summary (design D3) reaches exactly one
-        // agent as an ordinary mid-turn notice — the same proven delivery point
-        // as the settling and expiry notices.
-        const recoveryNotice = recoveryNotices.get(registry.rootOf(agent) ?? '')
-        if (recoveryNotice) {
-          recoveryNotices.delete(registry.rootOf(agent) ?? '')
-          try { deliverLocal(agent, recoveryNotice) } catch { /* the audit record is the durable account */ }
-        }
-        // A genuine user message arrived while this session was stopped: resume
-        // it and confirm its retained files BEFORE the turn's first step, so the
-        // edits the turn is about to request are admitted (message-driven
-        // auto-resume D1). A failure only warns and the turn proceeds denied —
-        // the panel keeps showing the stopped state (D6).
-        if (pendingAutoResume.get(agent) === true) {
-          pendingAutoResume.delete(agent)
-          if (domain.blocks(agent)) await autoResume(domain, agent, message => ctx.logger?.warn?.(message))
-        }
-        // The holder is working again: every lock it holds leaves the holding state at
-        // once, without waiting for the reservation to run out (design D4), and the
-        // notice budget for this batch restarts.
-        settle.turnStarted(agent)
-        void Promise.resolve(domain.turnStarted(agent)).catch((/** @type {any} */ error) => ctx.logger?.warn?.(`edit lock turn start failed: ${error?.message ?? error}`))
-      }
-    }
-    const domain = agent && settled.get(agent)
-    if (domain && signal && !watched.has(signal)) {
-      watched.add(signal)
-      const latch = () => { if (abortedByUser(signal)) domain.latch(agent) }
-      if (signal.aborted) latch()
-      else signal.addEventListener('abort', latch, { once: true })
-    }
-    return next()
-  })
-
-  // Message-driven auto-resume, phase 1 (D1): a genuine user message to the
-  // session arms the flag synchronously; runtime-injected (producer-tagged)
-  // messages never do. The arming hook is the inbox intake, NOT the durable
-  // user/message session event: that append only lands mid-turn in this
-  // runtime — past the new-turn pre-step the resume must precede (integration
-  // evidence: editlock-auto-resume). The setting is read per message, so a
-  // committed change applies without a restart (D5). The payload carries the
-  // agent, so no registry lookup is needed. Flag-set is synchronous-safe here
-  // (no followup, no session.append — AGENTS §3.4).
-  ctx.on('agent/inbox/inserted', (/** @type {any} */ { agent, message }) => {
-    if (!agent || !isGenuineUserMessage(message)) return
-    // Stale-lock sweep: the SAME genuine-message hook as auto-resume, but the
-    // sweep runs DETACHED — the turn never waits for it (unlike auto-resume,
-    // which must precede the first step). Coalesced per management-domain root
-    // (not per session) with a single in-flight sweep and a 60s cooldown; the
-    // setting is read per message so a committed change applies at once
-    // (default ON). Runtime-injected messages never reach this branch.
-    if (ctx.get?.('weirSettings')?.get?.('editLock')?.staleSweep !== false) {
-      const root = registry.rootOf(agent)
-      if (root) sweeps.trigger(root, () => {
-        // An agent disposed (or the plugin unmounted) before dispatch cancels
-        // its undispatched work; an already-submitted authority transaction
-        // is never cancelled or reinterpreted.
-        if (closed || disposedAgents.has(agent) || registry.rootOf(agent) !== root) return undefined
-        return registry.forRoot(root).then(domain => {
-          // Re-check at fulfillment: a dispose landing while the domain-open
-          // promise was pending must cancel here, before any maintenance
-          // transaction is submitted for a disposed agent.
-          if (closed || disposedAgents.has(agent)) return undefined
-          return domain.sweepStale(agent, sessionOf(agent))
-        })
-      })
-    }
-    if (ctx.get?.('weirSettings')?.get?.('editLock')?.autoResume === false) return
-    pendingAutoResume.set(agent, true)
-    // Message-driven binding self-heal (D5): the same genuine message arms ONE
-    // bounded retry of a recorded duplicate-binding failure, executed through
-    // the trusted retryBinding path at the next turn's first pre-step. Injected
-    // messages, timers, write calls and status reads never reach this branch.
-    if (bindingFailures.get(agent)?.code === 'binding-duplicate') pendingBindingRetry.set(agent, true)
-  })
-
-  // Classification and settling read only the durable turn/end reason
-  // (AGENTS §3.5): `error` classifies the locks abnormal, `completed` settles the
-  // locks the turn left behind, and `aborted` only latches. Nothing is inferred.
-  ctx.on('session/event', (/** @type {any} */ session, /** @type {any} */ event) => {
-    if (event?.type !== 'turn/end') return
-    const agent = ctx.get?.('agents')?.get?.(session?.id)
-    const domain = agent && settled.get(agent)
-    if (!domain) return
-    const classification = recovery.onTurnEnd(agent, event.data?.reason).catch((/** @type {any} */ error) => {
-      ctx.logger?.warn?.(`edit lock recovery classification failed: ${error?.message ?? error}`)
-    })
-    turnClassifications.set(agent, classification)
-    const reason = event.data?.reason
-    if (reason?.kind !== 'completed') return
-    // A reservation that ran out during the turn is released here (the turn is
-    // over, so the session counts as idle). Settling starts in the same tick, not
-    // after that release: a host that finishes when the agent goes idle would
-    // otherwise end before the follow-up is queued. Its own status read happens
-    // behind the release in the manager FIFO, so it sees the files already freed.
-    void Promise.resolve(domain.settleExpired(agent, true)).then(result => {
-      if (result?.released?.length) {
-        settle.settled(agent)
-        deliverLocal(agent, `Edit Lock: the reservation ended, so ${result.released.length} file(s) are available to other sessions.`)
-      }
-    }).catch((/** @type {any} */ error) => ctx.logger?.warn?.(`edit lock deferred release failed: ${error?.message ?? error}`))
-    settle.onTurnEnd(agent, reason)
-  })
-
-  // A reply tool may only disappear at a turn boundary, never mid-turn.
-  ctx.on('agent/turn-stopping', (/** @type {any} */ { agent }) => { retireReplyTool(agent) })
-  // disposeAgent and its disposalTasks moved into binding-machine.js (change
-  // edit-lock-deepening, design D3) — the destructured alias is shared below.
-  ctx.on('agent/disposed', ({ agent }) => disposeAgent(agent).catch(() => {}))
-
-  /** Cold-read fallback for the status view (design D1/D2): a session with no
-   * live agent is observed cold through sessionQuery (never activated), its
-   * management root derived from the observed cwd, and the authority image read
-   * READ-ONLY with the maintenance inspector's discipline — no runtime open, no
-   * reservation, not one byte mutated. Publisher AND client mode both answer
-   * from this local read: the authority is a shared file on this filesystem.
-   * Every failure degrades to an unavailable view with an explicit reason —
-   * never a reasonless "starting" for a session that cannot be starting.
-   * @param {string} sessionId */
-  async function coldStatusView(sessionId) {
-    if (platformFailure) return unavailableView(platformFailure.message)
-    let observation
-    try { observation = await ctx.get?.('sessionQuery')?.observeSession?.(sessionId) } catch { observation = undefined }
-    if (!observation) return unavailableView('session is not live in this process and could not be cold-read')
-    try {
-      const fixed = options.fixed
-      const cwd = observation.header?.cwd
-      /** @type {string} */
-      let root
-      /** @type {string} */
-      let directory
-      /** @type {string} */
-      let domainId
-      if (fixed) {
-        // A pinned composition serves exactly one authority; the observed cwd
-        // only names the files in the view.
-        root = fixed.root; directory = fixed.directory; domainId = fixed.root
-      } else {
-        try { root = resolveRoot(/** @type {string} */ (cwd)) } catch (error) { return unavailableView(`session working directory resolves no Edit Lock domain: ${errorMessage(error)}`) }
-        directory = join(root, AUTHORITY_DIR); domainId = root
-      }
-      const read = readSnapshotBytes(directory)
-      if (read.presence === 'no-authority') return unavailableView('workspace has no Edit Lock authority')
-      if (read.presence === 'no-snapshot') return unavailableView('workspace authority has no committed snapshot')
-      if (read.presence !== 'valid') return unavailableView(`authority snapshot unreadable: ${read.presence === 'unreadable' ? read.message : read.presence}`)
-      let snapshot
-      try { snapshot = parseSnapshot(read.bytes, domainId) } catch (error) { return unavailableView(`authority snapshot invalid: ${errorMessage(error)}`) }
-      const autoResume = ctx.get?.('weirSettings')?.get?.('editLock')?.autoResume !== false
-      return buildColdView({ image: snapshot.state, sessionId, cwd, root, autoResume, now: Date.now() })
-    } finally {
-      observation[Symbol.dispose]?.()
-    }
-  }
-  // Structured status for the panel (design D6). Reading the view grants nothing
-  // and writes nothing to the conversation; every action still goes through an
-  // explicit /edit-lock command so it stays on the record. `connection` is a
-  // host-plane service, so the isolated realm does not hide it.
-  /** @type {() => void} */
-  let offView = () => {}
-  ctx.inject?.(['connection'], (/** @type {any} */ scope) => {
-    const connection = scope.connection
-    if (!connection?.fetch?.register) return
-    // Duplicate-route tolerance (design D2): with several preset mounts in one
-    // process the first mount owns these process-wide routes, and the host
-    // connection refuses a later mount's identical registration. Skipping only
-    // that exact refusal keeps this mount's inject callback intact instead of
-    // aborting it mid-mount; correctness never depends on mount order because
-    // the surviving handler routes every agent to its owning mount (D1).
-    /** @type {(() => void) | undefined} */
-    let dispose
-    try { dispose = connection.fetch.register({
-      path: '/api/weir-edit-lock/view',
-      methods: ['POST'],
-      requestBody: 'buffered',
-      fetch: async (/** @type {any} */ request) => {
-        const reply = (/** @type {any} */ payload, status = 200) => new Response(JSON.stringify(payload), { status, headers: { 'content-type': 'application/json' } })
-        let body
-        try { body = await request.json() } catch { body = null }
-        const sessionId = typeof body?.sessionId === 'string' ? body.sessionId : ''
-        if (!sessionId) return reply({ ok: false, error: { code: 'weir-edit-lock/invalid', message: 'body needs { sessionId }' } }, 400)
-        const agent = ctx.get?.('agents')?.get?.(sessionId)
-        // Multi-mount routing (design D1): this route belongs to whichever
-        // mount happened to register first, but the answer must come from the
-        // mount that owns the agent. Resolve the agent's own weirEditLock
-        // instance through the preset registry (the own-preset fence's
-        // mechanism) and let its describe build the view; an absent, throwing
-        // or non-resolving registry falls back to this mount's local records
-        // below (design D4).
-        if (agent) {
-          /** @type {any} */
-          let owning = null
-          try { owning = typeof presets?.serviceFor === 'function' ? presets.serviceFor(agent, 'weirEditLock') : null } catch { owning = null }
-          if (owning && typeof owning.describe === 'function') {
-            try {
-              const described = await owning.describe(agent)
-              return reply({ ok: true, value: buildView({ status: described.status, locks: described.locks, recoveryState: described.recovery, cwd: agent?.session?.header?.cwd, root: described.root, mode: described.mode, now: Date.now() }) })
-            } catch (error) {
-              // Failure loudening (design D3): a failed binding names its
-              // reason; a reasonless "starting" is reserved for a genuinely
-              // in-flight setup (describe's await absorbs that window).
-              return reply({ ok: true, value: unavailableView(String(/** @type {any} */ (error)?.message ?? error), /** @type {any} */ (error)?.bindingFailure) })
-            }
-          }
-        }
-        const domain = agent && settled.get(agent)
-        // A live agent whose domain is still starting (or failed to start)
-        // keeps the old answer; only a session with NO live agent cold-reads.
-        if (agent && !domain) return reply({ ok: true, value: unavailableView(platformFailure?.message ?? startFailures.get(agent) ?? null, startupFailure(agent)?.bindingFailure) })
-        if (!domain) return reply({ ok: true, value: await coldStatusView(sessionId) })
-        try {
-          const [status, locks] = await Promise.all([domain.status(agent), domain.locks(agent)])
-          return reply({ ok: true, value: buildView({ status, locks, recoveryState: recovery.state(agent), cwd: agent?.session?.header?.cwd, root: registry.rootOf(agent), mode: domain.mode, now: Date.now() }) })
-        } catch (error) {
-          return reply({ ok: false, error: { code: 'weir-edit-lock/internal', message: /** @type {any} */ (error)?.message ?? String(error) } }, 500)
-        }
-      },
-    }) } catch (error) {
-      if (!duplicateRouteRegistration(error, '/api/weir-edit-lock/view')) throw error
-    }
-    // Online administrative recovery (design D4): the maintenance panel's
-    // one-click confirmation. Root membership is exact against the roots this
-    // process actually serves (never an open, never a client path read); the
-    // manager re-verifies every condition at its FIFO position. Refusals
-    // expose no filesystem detail beyond what inspect already shows.
-    /** @type {(() => void) | undefined} */
-    let disposeRecovery
-    try { disposeRecovery = connection.fetch.register({
-      path: '/api/weir-edit-lock/maintenance/recover-online',
-      methods: ['POST'],
-      requestBody: 'buffered',
-      fetch: async (/** @type {any} */ request) => {
-        const reply = (/** @type {any} */ payload, /** @type {number} */ status = 200) => new Response(JSON.stringify(payload), { status, headers: { 'content-type': 'application/json' } })
-        let body
-        try { body = await request.json() } catch { return reply({ ok: false, error: { code: 'weir-edit-lock/invalid', message: 'Invalid recovery JSON' } }, 400) }
-        const requested = body !== null && typeof body === 'object' && typeof body.root === 'string' ? body.root : ''
-        let canonicalRoot = ''
-        try { canonicalRoot = requested ? realpathSync.native(requested) : '' } catch { canonicalRoot = '' }
-        if (!canonicalRoot || !registry.known(canonicalRoot)) {
-          return reply({ ok: false, error: { code: 'weir-edit-lock/untrusted-root', message: 'not an Edit Lock domain root this server derived' } }, 403)
-        }
-        try {
-          const domain = await registry.forRoot(canonicalRoot)
-          // Server-derived trigger: one of THIS process's own agents bound to
-          // the domain. A client-mode domain needs it to carry the channel;
-          // a publisher-local domain uses it for the audit trigger only.
-          const agents = ctx.get?.('agents')?.roots?.() ?? []
-          const triggerAgent = agents.find((/** @type {any} */ agent) => registry.rootOf(agent) === canonicalRoot) ?? null
-          if (domain.mode !== 'publisher' && !triggerAgent) {
-            return reply({ ok: false, error: { code: 'weir-edit-lock/recovery-unavailable', message: 'no live session in this process can carry the recovery to the publisher', commitStatus: 'not-acknowledged' } }, 409)
-          }
-          const { root: _root, ...input } = body
-          const value = await domain.adminRecover(triggerAgent, input, sessionOf(triggerAgent) ?? null)
-          return reply({ ok: true, value })
-        } catch (error) {
-          const e = /** @type {any} */ (error)
-          const code = typeof e?.code === 'string' && e.code.startsWith('weir-edit-lock/') ? e.code : 'weir-edit-lock/recovery-refused'
-          return reply({ ok: false, error: { code, message: 'Recovery not acknowledged. Inspect authority and retry the same recovery ID after resolving the cause.',
-            detail: e?.recoveryRefusal === true ? String(e.message) : undefined, commitStatus: 'not-acknowledged' } }, 409)
-        }
-      },
-    }) } catch (error) {
-      if (!duplicateRouteRegistration(error, '/api/weir-edit-lock/maintenance/recover-online')) throw error
-    }
-    offView = () => { dispose?.(); disposeRecovery?.() }
-    return offView
-  })
-  const commands = ctx.get?.('commands')
-  const offCommand = commands?.register({
-    name: 'edit-lock',
-    description: 'Edit Lock: status, retry (connection only; not Continue), locks, hold [minutes], release <path>, stop (durable revoke), resume (explicit Continue), confirm <path> | --all, unlock <path> <generation>.',
-    input: { hint: 'status | retry | locks | hold [minutes] | release <path> | stop | resume | confirm <path> | unlock <path> <generation>' },
-    handler: async (/** @type {any} */ invocation) => {
-      const agent = invocation?.agent
-      if (!agent) return { kind: 'error', text: 'edit-lock: requires an owning agent session' }
-      try {
-        const raw = String(invocation.rawInput ?? '')
-        if (raw.trim() === 'retry') return { kind: 'success', text: await retryBinding(agent) }
-        const domain = await domainFor(agent)
-        // Only the hold verb depends on the retention settings being coherent.
-        const policy = /^\s*hold\b/.test(raw) ? strictLimits() : limits()
-        const text = await runCommand(domain, agent, raw, String(invocation.commandId), policy)
-        return { kind: 'success', text: `${text}\nDomain: ${registry.rootOf(agent)} (${domain.mode})` }
-      } catch (error) {
-        return { kind: 'error', text: `edit-lock: ${/** @type {any} */ (error)?.message ?? error}` }
-      }
-    },
-  })
-
-  if (!platformFailure) evidence?.installed()
-  return async () => {
-    if (closed) return
-    closed = true
-    liveServices.delete(service)
-    offDelegateLifecycle()
-    evidence?.disposing()
-    try {
-      // Cancel undispatched sweeps first; an already-running sweep's authority
-      // transactions drain with the domains below, never cancelled.
-      sweeps.close()
-      recovery.close()
-      settle.close()
-      offView()
-      offCommand?.()
-      for (const off of offTools) off?.()
-      // Retain uncertain evidence until every generation-owned domain is
-      // drained; only the LAST sharing disposer closes them (design D1).
-      await shared.release()
-      evidence?.dispose()
-    } catch (error) {
-      evidence?.failed(error)
-      ctx.logger?.warn?.(`edit lock shutdown incomplete; reservation retained: ${error?.message ?? error}`)
-    }
-  }
-  } catch (error) {
-    evidence?.failed(error)
-    // A mount that failed mid-apply must not stay counted in the shared
-    // registry (design D1); domains are lazy, so this release closes nothing
-    // unless a sibling mount already opened one — its count keeps it alive.
-    if (shared) void shared.release().catch(() => {})
-    throw error
-  }
-}
-}
-const apply = createEditLockPlugin()
-
-/** The host timer is an optional service: accessing an unavailable cordis service
- * throws rather than yielding undefined, so it is probed explicitly. Returning
- * undefined lets the caller fall back to the platform timer.
- * @param {any} ctx */
-function safeSetTimer(ctx) {
-  try {
-    const timer = ctx?.setTimeout
-    return typeof timer === 'function' ? timer.bind(ctx) : undefined
-  } catch { return undefined }
-}
-/** The host connection refuses a second registration of an exact route path
- * with this precise message (dsh-client-connection); only that refusal may be
- * skipped by a later mount — every other registration error still aborts the
- * mount. @param {any} error @param {string} path */
-function duplicateRouteRegistration(error, path) {
-  return /** @type {any} */ (error)?.message === `connection: exact Fetch route ${JSON.stringify(path)} is already registered`
-}
-/** Any abort latches (denial is always safe) except disposal, which
- * agent/disposed revokes and forgets. @param {AbortSignal} signal */
-function abortedByUser(signal) {
-  return /** @type {any} */ (signal.reason)?.kind !== 'disposed'
-}
-
-export { name, inject, apply }