weir-harness 1.2.3 → 2.1.0

package/src/edit-lock/reservation.js

@@ -1,301 +0,0 @@
-/// <reference path="../capabilities/store/checked-contract.d.ts" />
-import { mkdirSync, realpathSync, lstatSync, rmdirSync, readdirSync, readFileSync, writeFileSync, renameSync, unlinkSync, openSync, fsyncSync, closeSync, constants } from 'node:fs'
-import { dirname, basename, join } from 'node:path'
-import { randomBytes } from 'node:crypto'
-import { createLiveness } from '../capabilities/store/liveness.js'
-import { parseOwnerDoc } from '../capabilities/store/lock.js'
-import { canonical } from './snapshot.js'
-
-/** Deterministic sibling of a canonical authority directory.
- * @param {string} authority */
-export function reservationPathFor(authority) {
-  return join(dirname(authority), `.${basename(authority)}.publisher-reservation`)
-}
-
-// Lease defaults (spike 0.1, openspec edit-lock-autonomous-recovery): the lease
-// bounds crash-detection latency, the renewal period bounds its cost. Renewal
-// is a temp+rename of one small file and costs single-digit milliseconds even
-// under load, so a 30s/10s pair keeps detection latency human-scale at
-// negligible IO cost. A timeout ALONE never justifies reclamation: the
-// recorded owner must also be proven dead by the shared Liveness adapter.
-export const RESERVATION_LEASE_MS = 30_000
-export const RESERVATION_RENEW_MS = 10_000
-
-const OWNER_FILE = 'owner.json'
-
-/** @param {unknown} error @param {...string} codes */
-const hasCode = (error, ...codes) => codes.includes(/** @type {{ code?: string }} */ (error)?.code ?? '')
-
-/** Read and parse the owner document of a reservation directory.
- * @param {string} path @returns {ReturnType<typeof parseOwnerDoc>} */
-function readOwner(path) {
-  let text
-  try {
-    text = readFileSync(join(path, OWNER_FILE), 'utf8')
-  } catch (error) {
-    if (hasCode(error, 'ENOENT')) return { kind: /** @type {const} */ ('absent') }
-    throw error
-  }
-  return parseOwnerDoc(text)
-}
-
-/** Atomic full-content owner publication inside the reservation directory
- * (temp + rename; a crash leaves an orphan temp, never a torn owner.json).
- * @param {string} path @param {import('../capabilities/store/lock.js').OwnerDoc} doc */
-function writeOwner(path, doc) {
-  const temporary = join(path, `.owner-${doc.ownerToken}.tmp`)
-  writeFileSync(temporary, JSON.stringify(doc), { mode: 0o600 })
-  renameSync(temporary, join(path, OWNER_FILE))
-}
-
-// fsync on a directory handle is a POSIX crash-durability idiom: on Windows
-// the handle opens but fsync fails EPERM (verified on Node v24, NTFS), so the
-// win32 row skips it — the owner temp+rename stands on NTFS journaling.
-/** @param {string} directory */
-function syncParent(directory) {
-  if (process.platform !== 'darwin' && process.platform !== 'linux') return
-  const handle = openSync(directory, constants.O_RDONLY | (constants.O_DIRECTORY ?? 0))
-  try { fsyncSync(handle) } finally { closeSync(handle) }
-}
-
-/** True while the recorded owner document is exactly the one we observed
- * (same token, same lease): any renewal or replacement aborts a reclaim.
- * @param {import('../capabilities/store/lock.js').OwnerDoc} a @param {import('../capabilities/store/lock.js').OwnerDoc} b */
-const sameOwner = (a, b) => canonical(a) === canonical(b)
-
-/** Conservative cross-process reservation for one preconfigured authority
- * directory on a local filesystem. All cooperating hosts MUST use the same
- * authority directory; this is not discovery for overlapping workspace roots.
- *
- * Liveness stance (design D1): the reservation carries an owner document
- * (pid/host/startIdentity/lease, schema-aligned with the capability-store
- * OwnerDoc) that the holder renews periodically. A crash leaves the directory
- * in place; a newcomer finding it reclaims it ONLY when the lease has expired
- * AND the recorded owner is proven dead (same host, same boot, pid gone or
- * start-identity mismatch) — through a serialized `<reservation>.recover`
- * lock with a re-read before the rename, so a reservation naming a live owner
- * is never removed. Every other outcome (lease current, owner alive, owner
- * state unknown, owner document absent/corrupt) keeps the historical
- * behavior: the newcomer becomes a client (EEXIST).
- * @param {string} directory
- * @param {{ liveness?: import('../capabilities/store/liveness.js').Liveness,
- *   leaseMs?: number, renewMs?: number, now?: () => number,
- *   token?: () => string,
- *   testing?: { checkpoint?: (point: string) => void|Promise<void> }}} [options] */
-export async function reservePublisher(directory, options = {}) {
-  const authority = realpathSync.native(directory)
-  if (!lstatSync(authority).isDirectory()) throw new Error('authority directory required')
-  if (dirname(authority) === authority) throw new Error('filesystem root cannot be authority directory')
-  const liveness = options.liveness ?? createLiveness()
-  const leaseMs = options.leaseMs ?? RESERVATION_LEASE_MS
-  const renewMs = options.renewMs ?? RESERVATION_RENEW_MS
-  const now = options.now ?? Date.now
-  const token = options.token ?? (() => randomBytes(12).toString('hex'))
-  const testing = options.testing ?? {}
-  // Keep the store directory empty for initial creation; use a deterministic
-  // sibling reservation tied to the canonical authority path.
-  const path = reservationPathFor(authority)
-
-  /** @param {string} ownerToken @returns {Promise<import('../capabilities/store/lock.js').OwnerDoc>} */
-  async function ownerDoc(ownerToken) {
-    const startIdentity = await liveness.identity()
-    const at = now()
-    return {
-      schemaVersion: 1, ownerToken, pid: liveness.pid, host: liveness.host,
-      startIdentity, acquiredAt: at, leaseUntil: at + leaseMs,
-    }
-  }
-
-  /**
-   * Serialized reclamation of a reservation whose observed owner is expired
-   * and proven dead. The `<reservation>.recover` directory serializes
-   * concurrent reclaimers and stays GENUINELY exclusive for the whole
-   * takeover → reservation-replacement → cleanup sequence:
-   *
-   * - An abandoned recovery lock is taken over only after re-verifying, past
-   *   the awaited death check, that the directory renamed aside is still the
-   *   exact one observed (same dev/ino, same owner document). A live
-   *   reclaimer that took over in the window changed both, so a stale
-   *   observation can never rename a LIVE recovery lock aside.
-   * - The takeover immediately publishes OUR owner document and anchors the
-   *   lock to the created directory's dev/ino identity.
-   * - Immediately before the reservation rename, the recovery lock must still
-   *   carry our identity AND our owner document, and the reservation must
-   *   still name the observed dead owner. Any drift loses the reclaim.
-   * - Cleanup removes the recovery lock only while it is still the directory
-   *   we created, so a loser never deletes the winner's lock.
-   *
-   * Test-only checkpoints surround the decision points; they never replace
-   *   filesystem calls. @param {import('../capabilities/store/lock.js').OwnerDoc} observed */
-  async function reclaim(observed) {
-    const recoverPath = `${path}.recover`
-    const recoverToken = token()
-    let held = false
-    /** @type {{ dev: bigint, ino: bigint }|null} */
-    let ours = null
-    /** The dev/ino of the recovery directory right now (null when absent).
-     * @returns {{ dev: bigint, ino: bigint }|null} */
-    const statRecover = () => {
-      try {
-        const stat = lstatSync(recoverPath, { bigint: true })
-        return stat.isDirectory() ? { dev: stat.dev, ino: stat.ino } : null
-      } catch (error) {
-        if (hasCode(error, 'ENOENT')) return null
-        throw error
-      }
-    }
-    /** @param {string} message */
-    const lost = message => Object.assign(new Error(`${message}: EEXIST`), { code: 'EEXIST' })
-    try {
-      mkdirSync(recoverPath, { mode: 0o700 })
-      held = true
-    } catch (error) {
-      if (!hasCode(error, 'EEXIST')) throw error
-      // A previous reclaimer holds (or abandoned) the serialization lock. It
-      // can be retaken only when its own owner is expired and proven dead; a
-      // crashed reclaimer that already renamed the reservation aside left NO
-      // reservation behind, so an existing reservation naming the dead owner
-      // means the interrupted reclaim never moved it. Anything else fails
-      // closed: the caller becomes a client, exactly as with a live publisher.
-      const observedLock = statRecover()
-      const recover = readOwner(recoverPath)
-      if (observedLock === null || recover.kind !== 'ok' || recover.value.leaseUntil > now() ||
-          (await liveness.state(recover.value)) !== 'dead') throw error
-      await testing.checkpoint?.('takeover-observed')
-      // The awaited death check makes the observation above STALE: another
-      // reclaimer may have completed its own takeover in between. Rename the
-      // abandoned lock aside only while it is still the exact directory we
-      // observed — same dev/ino and same owner document. Renaming a LIVE
-      // reclaimer's lock aside on a stale observation would hand two
-      // processes the serialization of one reclaim.
-      const current = statRecover()
-      const again = readOwner(recoverPath)
-      if (current === null || current.dev !== observedLock.dev || current.ino !== observedLock.ino ||
-          again.kind !== 'ok' || !sameOwner(again.value, recover.value)) throw error
-      try {
-        renameSync(recoverPath, `${recoverPath}.stale.${token()}`)
-      } catch (renameError) {
-        // A racer moved the observed directory aside first: the takeover is
-        // lost and the caller becomes a client, never a second reclaimer.
-        if (hasCode(renameError, 'ENOENT')) throw error
-        throw renameError
-      }
-      mkdirSync(recoverPath, { mode: 0o700 })
-      held = true
-    }
-    try {
-      // Anchor the lock to the directory WE created, then publish our owner
-      // document at once: from here on an identity mismatch is a lost
-      // takeover — never a reason to proceed, and never something to clean up.
-      const created = lstatSync(recoverPath, { bigint: true })
-      ours = { dev: created.dev, ino: created.ino }
-      const doc = await ownerDoc(recoverToken)
-      writeOwner(recoverPath, doc)
-      // Immediately before the reservation rename, prove (a) the recovery
-      // lock is still exclusively ours — same dev/ino captured at takeover
-      // and still carrying OUR owner document — and (b) the reservation
-      // still names the observed dead owner. Any drift aborts the reclaim.
-      const lock = statRecover()
-      const mine = readOwner(recoverPath)
-      if (lock === null || lock.dev !== ours.dev || lock.ino !== ours.ino ||
-          mine.kind !== 'ok' || !sameOwner(mine.value, doc)) throw lost('recovery lock lost before reclaim')
-      const again = readOwner(path)
-      if (again.kind !== 'ok' || !sameOwner(again.value, observed)) {
-        throw lost('publisher reservation changed before reclaim')
-      }
-      await testing.checkpoint?.('before-reservation-rename')
-      renameSync(path, `${path}.stale.${recoverToken}`)
-      mkdirSync(path, { mode: 0o700 })
-      syncParent(dirname(path))
-      return true
-    } finally {
-      if (held && ours !== null) {
-        // Remove the serialization lock ONLY while it is still the directory
-        // we created: after a lost takeover the same path belongs to another
-        // reclaimer, and deleting it would break their exclusion.
-        const lock = statRecover()
-        if (lock !== null && lock.dev === ours.dev && lock.ino === ours.ino) {
-          try { unlinkSync(join(recoverPath, OWNER_FILE)) } catch (error) { if (!hasCode(error, 'ENOENT')) throw error }
-          try { rmdirSync(recoverPath) } catch (error) { if (!hasCode(error, 'ENOENT')) throw error }
-        }
-      }
-    }
-  }
-
-  // The owner document is computed BEFORE the election so the mkdir → publish
-  // window is as short as the filesystem allows. A crash inside even that
-  // window leaves a reservation without an owner document, which every
-  // newcomer treats like the historical stale reservation: become a client.
-  let doc = await ownerDoc(token())
-  try {
-    mkdirSync(path, { mode: 0o700 })
-  } catch (error) {
-    if (!hasCode(error, 'EEXIST')) throw error
-    const observed = readOwner(path)
-    // Any deviation from "expired lease AND provably dead owner" keeps the
-    // historical client fallback: timeout alone never justifies reclamation.
-    if (observed.kind !== 'ok' || observed.value.leaseUntil > now() ||
-        (await liveness.state(observed.value)) !== 'dead' || !(await reclaim(observed.value))) {
-      throw error
-    }
-  }
-  writeOwner(path, doc)
-  syncParent(dirname(path))
-  const identity = lstatSync(path, { bigint: true })
-  /** The renewal may only ever write into the directory WE created: after a
-   * legitimate replacement (reclaim) the same path belongs to another owner,
-   * and renaming our document into it would clobber their lease. */
-  const ours = () => {
-    try {
-      const current = lstatSync(path, { bigint: true })
-      return current.isDirectory() && current.dev === identity.dev && current.ino === identity.ino
-    } catch { return false }
-  }
-  let released = false
-  /** @type {unknown} */
-  let renewalFailure
-  const renewal = setInterval(() => {
-    try {
-      if (!ours()) throw new Error('publisher reservation replaced')
-      doc = { ...doc, leaseUntil: now() + leaseMs }
-      writeOwner(path, doc)
-    } catch (error) {
-      // A renewal that cannot land must not masquerade as a live lease:
-      // exclusivity checks fail closed from here on; a later newcomer still
-      // needs the death proof to reclaim, so this only hurts the owner.
-      renewalFailure = error
-      clearInterval(renewal)
-    }
-  }, renewMs)
-  renewal.unref?.()
-  function assertExclusive() {
-    if (released) throw new Error('publisher reservation released')
-    if (renewalFailure) throw new Error('publisher reservation renewal failed', { cause: renewalFailure })
-    const current = lstatSync(path, { bigint: true })
-    if (!current.isDirectory() || current.isSymbolicLink() || current.dev !== identity.dev || current.ino !== identity.ino
-      || realpathSync.native(path) !== path) throw new Error('publisher reservation replaced')
-  }
-  return Object.freeze({
-    assertExclusive,
-    /** The owner document as last (re)published; read-only observation. */
-    owner: () => ({ ...doc, startIdentity: { ...doc.startIdentity } }),
-    /** The owner must close every admission and await every native publisher
-     * before release. A failed drain MUST leave this reservation in place. */
-    releaseAfterQuiescence() {
-      if (released) return
-      clearInterval(renewal)
-      assertExclusive()
-      // The resolved absolute target and original inode were checked above.
-      // Never recursive: unexpected contents retain the reservation — intact,
-      // owner document included, so a retained reservation stays reclaimable
-      // under the same death-proof rule as a crashed one. Only our own
-      // document (and its transient temp) are ever removed here.
-      const contents = readdirSync(path).filter(entry => entry !== OWNER_FILE && entry !== `.owner-${doc.ownerToken}.tmp`)
-      if (contents.length > 0) throw new Error(`publisher reservation has unexpected contents: ${contents[0]}`)
-      try { unlinkSync(join(path, `.owner-${doc.ownerToken}.tmp`)) } catch (error) { if (!hasCode(error, 'ENOENT')) throw error }
-      try { unlinkSync(join(path, OWNER_FILE)) } catch (error) { if (!hasCode(error, 'ENOENT')) throw error }
-      rmdirSync(path)
-      released = true
-    },
-  })
-}

package/src/edit-lock/reserved-runtime.js

@@ -1,45 +0,0 @@
-import { reservePublisher } from './reservation.js'
-import { openEditLockRuntime } from './runtime.js'
-import { createLiveness } from '../capabilities/store/liveness.js'
-
-/** Open only after exclusive reservation. A failure to OPEN releases it (nothing
- * was published); a crash or failed drain after opening retains it for
- * operator-assisted recovery. Callers never auto-promote after a disconnect.
- * `mode` may be decided only after the reservation is held.
- * @param {Omit<Parameters<typeof openEditLockRuntime>[0], 'assertExclusive'|'mode'> & {mode: 'create'|'recover'|(() => 'create'|'recover'),
- *   reservation?: Parameters<typeof reservePublisher>[1]}} options */
-export async function openReservedEditLockRuntime(options) {
-  // One Liveness adapter per domain open (design D1/D2): the reservation
-  // owner document, the incarnation process identity and the dead-process
-  // settlement probe all read the same process facts.
-  const liveness = options.reservation?.liveness ?? createLiveness()
-  const reservation = await reservePublisher(options.directory, { ...options.reservation, liveness })
-  let runtime
-  try {
-    const mode = typeof options.mode === 'function' ? options.mode() : options.mode
-    const startIdentity = await liveness.identity()
-    const processIdentity = { pid: liveness.pid, host: liveness.host, osStart: startIdentity.osStart, bootNonce: startIdentity.bootNonce }
-    runtime = await openEditLockRuntime({...options, mode, assertExclusive:reservation.assertExclusive, processIdentity, liveness})
-  } catch (error) {
-    // The runtime never opened, so this process published nothing under the
-    // reservation: it is provably quiescent and must not strand its own claim.
-    // Keeping it made the next attempt in the SAME process see EEXIST, take the
-    // client path and fail closed against a socket nobody serves.
-    try { reservation.releaseAfterQuiescence() } catch { /* replaced: leave it for a human */ }
-    throw error
-  }
-  /** @type {Promise<void> | undefined} */
-  let closing
-  return Object.freeze({
-    control: runtime.control,
-    requests: runtime.requests,
-    automaticRecovery: runtime.automaticRecovery ?? null,
-    close() {
-      if (!closing) closing = (async () => {
-        await runtime.close()
-        reservation.releaseAfterQuiescence()
-      })()
-      return closing
-    },
-  })
-}

package/src/edit-lock/resource-identity.js

@@ -1,130 +0,0 @@
-import { lstatSync, readlinkSync, realpathSync, statSync } from 'node:fs'
-import { dirname, isAbsolute } from 'node:path'
-
-/**
- * @typedef {Readonly<{ kind: 'file', resourceId: string }> |
- *   Readonly<{ kind: 'missing', ancestor: string, suffix: string }>} Observation
- * @typedef {{ value: Observation, witnesses: string[], links: number }} Inspection
- * @typedef {{ filePath: string, cwd: string, kind: Observation['kind'],
- *   witnesses: string[], links: number }} Evidence
- */
-
-/**
- * Read-only filesystem observations, not ownership or publication authority.
- * Filesystem calls are not an atomic snapshot: callers must coordinate mutation.
- * dev/ino continuity cannot detect inode reuse or change-and-restore (ABA).
- *
- * Verified platform rows: darwin/linux (POSIX spellings) and win32
- * (openspec windows-platform-adaptation: drive-letter absolute spellings with
- * both separators normalized to '/'; NTFS dev/ino/nlink verified real on Node
- * v24; junctions are reparse points and surface as symbolic links). UNC and
- * device paths are rejected on win32 — network shares are outside the
- * supported envelope (edit-lock.md).
- * @param {{ platform?: string }} [options]
- */
-export function createResourceIdentity({ platform = process.platform } = {}) {
-  if (platform !== 'darwin' && platform !== 'linux' && platform !== 'win32') {
-    throw new Error(`unsupported platform: ${platform}`)
-  }
-  const win = platform === 'win32'
-  /** @type {WeakMap<object, Evidence>} */
-  const observations = new WeakMap()
-  /** @param {string} filePath @param {{ cwd: string }} options */
-  function resolve(filePath, { cwd }) {
-    if (typeof cwd !== 'string' || !isAbsolute(cwd)) throw new TypeError('expected absolute cwd')
-    if (typeof filePath !== 'string' || filePath.length === 0) throw new TypeError('expected non-empty path')
-    if (filePath.includes('\0') || cwd.includes('\0')) throw new TypeError('NUL in path')
-    const joined = isAbsolute(filePath) ? filePath : `${cwd}/${filePath}`
-    const result = inspect(win ? normalizeWin(joined) : joined, win)
-    const observation = Object.freeze(result.value)
-    observations.set(observation, { filePath, cwd, kind: observation.kind, witnesses: result.witnesses, links: result.links })
-    return observation
-  }
-  return {
-    resolve,
-    /** @param {unknown} observation @returns {Observation} */
-    revalidate(observation) {
-      if (observation === null || typeof observation !== 'object') throw new Error('unknown observation')
-      const original = observations.get(observation)
-      if (!original) throw new Error('unknown observation')
-      const fresh = resolve(original.filePath, { cwd: original.cwd })
-      const current = observations.get(fresh)
-      if (!current || fresh.kind !== original.kind || current.links !== original.links ||
-          original.witnesses.some((witness, index) => witness !== current.witnesses[index])) {
-        throw new Error('topology changed')
-      }
-      return fresh
-    },
-  }
-}
-
-/** Canonical spelling for the win32 walk: single forward slashes under a
- * drive-letter root. UNC/device roots are rejected, never reinterpreted.
- * @param {string} spelling */
-function normalizeWin(spelling) {
-  const normalized = spelling.replace(/\\/g, '/').replace(/\/{2,}/g, '/')
-  if (!/^[A-Za-z]:\//.test(normalized)) throw new Error(`unsupported path root (drive-letter absolute paths only): ${spelling.slice(0, 64)}`)
-  return normalized
-}
-
-/** Walk original prefixes without lexically collapsing symlink/.. or missing/..
- * The ancestor chain terminates at the filesystem root of the spelling —
- * '/' on POSIX, '<drive>:/' on win32 — detected as dirname's fixed point.
- * @param {string} spelling @param {boolean} win @returns {Inspection} */
-function inspect(spelling, win) {
-  const parts = spelling.split('/')
-  let ancestor = win ? /** @type {string} */ (parts[0]) : '/'
-  const witnesses = []
-  let links = 0
-  for (let index = 1; index < parts.length; index++) {
-    const prefix = parts.slice(0, index + 1).join('/') || '/'
-    let entry
-    try {
-      entry = lstatSync(prefix, { bigint: true })
-    } catch (error) {
-      if (!(error instanceof Error) || !('code' in error) || error.code !== 'ENOENT') throw error
-      const suffix = parts.slice(index).join('/')
-      if (parts.slice(index).includes('..')) throw new Error('missing path contains ..')
-      return { value: { kind: 'missing', ancestor, suffix }, witnesses, links }
-    }
-    if (entry.isSymbolicLink()) links++
-    const physical = `${ancestor}/${parts[index]}`
-    ancestor = realpathSync.native(prefix)
-    const node = statSync(ancestor, { bigint: true })
-    witnesses.push(`${ancestor}:${node.dev}:${node.ino}:${entry.dev}:${entry.ino}`)
-    if (entry.isSymbolicLink()) traceLink(physical, witnesses, 0, win)
-    for (let parent = dirname(ancestor); ; parent = dirname(parent)) {
-      const directory = statSync(parent, { bigint: true })
-      witnesses.push(`${parent}:${directory.dev}:${directory.ino}`)
-      if (parent === dirname(parent)) break
-    }
-    if (index < parts.length - 1) {
-      if (!node.isDirectory()) throw new Error('non-directory ancestor')
-    } else if (!node.isFile() || node.nlink !== 1n) {
-      throw new Error('not editable: expected a single-link regular file')
-    }
-  }
-  return { value: { kind: 'file', resourceId: ancestor }, witnesses, links }
-}
-
-/** Witness every target hop from an already-witnessed physical parent. Advancing
- * the physical cursor avoids recursively replaying the original parent spelling.
- * Resolve each component only AFTER tracing it: lexical .. collapse or resolving
- * the whole target up front would hide nested links and their topology changes.
- * On win32 readlink returns backslash spellings; they are normalized before the
- * walk so component splitting matches the POSIX row.
- * @param {string} path @param {string[]} witnesses @param {number} depth @param {boolean} win */
-function traceLink(path, witnesses, depth, win) {
-  if (depth >= 40) throw new Error('unsupported symlink depth')
-  const target = win ? readlinkSync(path).replace(/\\/g, '/') : readlinkSync(path)
-  witnesses.push(`link:${path}:${target}`)
-  let parent = isAbsolute(target) ? (win ? /** @type {string} */ (target.split('/')[0]) : '/') : dirname(path)
-  const parts = isAbsolute(target) ? target.split('/').slice(1) : target.split('/')
-  for (const part of parts) {
-    const prefix = `${parent}/${part}`
-    const node = lstatSync(prefix, { bigint: true })
-    witnesses.push(`${prefix}:${node.dev}:${node.ino}`)
-    if (node.isSymbolicLink()) traceLink(prefix, witnesses, depth + 1, win)
-    parent = realpathSync.native(prefix)
-  }
-}

package/src/edit-lock/runtime.js

@@ -1,145 +0,0 @@
-import { realpathSync, statSync, constants } from 'node:fs'
-import { open, rename } from 'node:fs/promises'
-import { join, relative, isAbsolute } from 'node:path'
-import { randomUUID } from 'node:crypto'
-import { openEditLockStore } from './store.js'
-import { createEditLockManager, recoverEditLockManager } from './manager.js'
-import { createPublisher } from './publisher.js'
-import { reservationPathFor } from './reservation.js'
-
-const domains = new Set()
-
-/** Durable publication of one administrative backup artifact inside the
- * authority directory (temp + rename + directory sync, like the snapshot).
- * @param {string} directory @param {string} file @param {Buffer} bytes */
-async function writeAuthorityFile(directory, file, bytes) {
-  const temporary = join(directory, `.backup-${randomUUID()}.tmp`)
-  const handle = await open(temporary, 'wx', 0o600)
-  try { await handle.writeFile(bytes); await handle.sync() } finally { await handle.close() }
-  await rename(temporary, join(directory, file))
-  // Directory fsync is POSIX-only (EPERM on win32): the file fsync above and
-  // the atomic rename stand alone there (reservation.js SYNC_SUPPORTED stance).
-  if (process.platform !== 'darwin' && process.platform !== 'linux') return
-  const dir = await open(directory, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW)
-  try { await dir.sync() } finally { await dir.close() }
-}
-
-/** Internal host lifecycle, not a model-facing service. Process-local exclusion
- * supplements, but does not replace, the caller's cross-process lifecycle lease.
- * The optional process identity and Liveness adapter (design D2/D3) come from
- * the reservation layer: the incarnation is registered in the durable image,
- * and a recovery open administratively settles unknown publications of
- * provably dead incarnation processes in the recovery commit.
- * @param {{directory: string, root: string, domainId: string, mode: 'create'|'recover',
- * fs: Parameters<typeof createPublisher>[0]['fs'],
- * assertExclusive: () => void,
- * processIdentity?: import('./incarnations.js').ProcessIdentity|null,
- * liveness?: import('../capabilities/store/liveness.js').Liveness|null}} options */
-export async function openEditLockRuntime(options) {
-  options.assertExclusive()
-  const root = realpathSync.native(options.root)
-  if (!statSync(root).isDirectory()) throw new Error('management root must be directory')
-  if (domains.has(root)) throw new Error('management domain already open')
-  if (!isAbsolute(options.directory)) throw new Error('absolute authority directory required')
-  const directory = realpathSync.native(options.directory)
-  // The authority may live inside the domain, but its files and reservation
-  // are never targets of the managed business publisher.
-  const excluded = [directory, reservationPathFor(directory)]
-  if (excluded.some(path => path === root || !relative(path, root).startsWith('..'))) throw new Error('authority directory must not contain the business domain')
-  domains.add(root)
-  /** @type {Awaited<ReturnType<typeof openEditLockStore>> | undefined} */
-  let store
-  try {
-    store = await openEditLockStore({ directory, domainId: options.domainId, mode: options.mode })
-    const openedStore = store
-    const processIdentity = options.processIdentity ?? null
-    const liveness = options.liveness ?? null
-    /** @type {{records: any[], revision: number}|null} */
-    let automaticRecovery = null
-    // The domain root and backup writer are always supplied: the online
-    // administrative recovery transaction (design D4) needs them even when
-    // no Liveness adapter is present; the automatic settlement (D3) still
-    // requires the full identity chain and stays gated inside the manager.
-    const manager = options.mode === 'recover'
-      ? await recoverEditLockManager({ store, managerIncarnation: randomUUID(), processIdentity, liveness,
-        root: options.domainId,
-        writeBackup: (file, bytes) => writeAuthorityFile(directory, file, bytes),
-        onAutomaticRecovery: info => { automaticRecovery = info } })
-      : createEditLockManager({ store, managerIncarnation: randomUUID(), processIdentity,
-        root: options.domainId,
-        writeBackup: (file, bytes) => writeAuthorityFile(directory, file, bytes) })
-    const publisher = createPublisher({ manager, fs: options.fs, root, excluded, assertExclusive: options.assertExclusive })
-    let closing = false
-    /** @type {Promise<void> | undefined} */
-    let shutdown
-    /** @type {Set<Promise<any>>} */
-    const pending = new Set()
-    /** @template T @param {() => Promise<T>} action */
-    function run(action) {
-      if (closing) throw new Error('edit lock runtime closing')
-      options.assertExclusive()
-      const work = action()
-      pending.add(work)
-      void work.then(() => pending.delete(work), () => pending.delete(work))
-      return work
-    }
-    // Preserve synchronous cancellation overlays while sealing every public
-    // control admission. Manager FIFO drain covers asynchronous control work.
-    const control = new Proxy({ ...manager }, {
-      get(target, property, receiver) {
-        const method = Reflect.get(target, property, receiver)
-        if (typeof method !== 'function') return method
-        return (/** @type {any[]} */ ...args) => {
-          if (closing) throw new Error('edit lock runtime closing')
-          options.assertExclusive()
-          return method.apply(target, args)
-        }
-      },
-    })
-    return Object.freeze({
-      // Trusted host control only; must never be passed to a tool's arguments.
-      control,
-      /** Dead-process unknowns settled in the recovery commit (design D3), or null. */
-      automaticRecovery,
-      requests: Object.freeze({
-        /** @param {import('./state.js').Execution} execution @param {string[]} paths @param {string} cwd */
-        acquireBatch(execution, paths, cwd) { return run(() => publisher.acquireBatch(execution, paths, cwd)) },
-        /** @param {string} path @param {string} cwd */
-        resource(path, cwd) {
-          if (closing) throw new Error('edit lock runtime closing')
-          return publisher.resource(path, cwd)
-        },
-        /** @param {string} path @param {string} cwd */
-        releaseResource(path, cwd) {
-          if (closing) throw new Error('edit lock runtime closing')
-          return publisher.releaseResource(path, cwd)
-        },
-        /** @param {Parameters<typeof publisher.release>[0]} token
-         * @param {Parameters<typeof publisher.release>[1]} observation */
-        release(token, observation) { return run(() => publisher.release(token, observation)) },
-        /** @param {Parameters<typeof publisher.prepare>[0]} execution
-         * @param {Parameters<typeof publisher.prepare>[1]} request
-         * @param {AbortSignal} signal */
-        prepare(execution, request, signal) { return run(() => publisher.prepare(execution, request, signal)) },
-        /** @param {object} submission */
-        commit(submission) { return run(() => publisher.commit(submission)) },
-      }),
-      close() {
-        if (shutdown) return shutdown
-        closing = true
-        shutdown = (async () => {
-          await Promise.allSettled([...pending])
-          await manager.drain()
-          await manager.close()
-          await openedStore.close()
-          domains.delete(root)
-        })()
-        return shutdown
-      },
-    })
-  } catch (error) {
-    if (store) await store.close()
-    domains.delete(root)
-    throw error
-  }
-}