{"entries":[{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-29T16:58:29.000000-07:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-29T16:58:29.000000-07:00"},"hash":"9c82b31e7a55266d07bcbf7faa5b4a872ebbf108","message":"Unify goal endings with typed close records (#24)\n\n* Unify goal endings with typed close records\n\nCo-Authored-By: codexbot.disnetdev.com (did:plc:hbonvqr5ysrscg5wdyb5klie) \n\n* Answer the review on the goal-ending change\n\nThe fold no longer lets a legacy `archiveGoal{archived:false}` reopen a goal its\nauthor had closed. `goal.closed` and `archiveGoal` are two independent legacy\ndimensions, so an archive record can only ADD its park; a `closeGoal` — the one\naxis — still decides the state outright in either direction, and a goal carrying\nboth legacy signals reports the closure that actually happened.\n\nAlso from the review:\n\n- The golden scenario now carries all three ending signals on one goal, tied on\n the instant across collections, so the 200-permutation whole-index test covers\n the new record; `archive.test.mjs` becomes `ending.test.mjs` with the fold\n matrix and 100 permutations of its own. The fixture ends a goal each way, so\n demo mode draws every disposition and an `endedAt`.\n- `liveTargets` delegating to `activeGoals()` is stated as the deliberate\n reader-side change it is — docstring, CHANGELOG, and an exact count in\n `verdicts.test.ts` rather than an existence check.\n- Dropping the `archiveGoal` and `goal?action=update` permissions narrows an\n already-issued token's scope, so a scope refusal now says that signing out and\n in again is the fix, and the CHANGELOG says so too.\n- Only `completed` keeps the sage ✓; `dropped`, `superseded`, `parked` and an\n unknown word are `flat`, through one shared `endingBadge`.\n- `--disposition` is refused when the lexicon could not carry it and warned when\n it is outside the documented vocabulary; `goal unarchive` no longer writes a\n `parked` annotation onto a reopen.\n- The disposition picker is a styled `select.sl` with a paired label.\n- `isClosed`, `ownsGoal` and `RepoWriteAction`'s unreachable `'update'` are gone.\n- design.md §4/§7/§12 specify the new model and name what it supersedes;\n phase6-ui-plan §3.5 and its 6.7 note are marked superseded; the stale\n \"two endings\"/\"sanctioned owner edit\" comments across core, atproto, sidecar,\n daemon and the UI now describe the model in the tree.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n---------\n\nCo-authored-by: codexbot.disnetdev.com (did:plc:hbonvqr5ysrscg5wdyb5klie) \nCo-authored-by: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) ","tree":"bb4cc6586eaf53c487c484edf786baabb50e9312"},"mode":"0100644","name":"client.ts","size":37003},{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-27T15:56:54.000000-07:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-27T15:56:54.000000-07:00"},"hash":"ac5a07742d578fd1aa919bc4e8510899ffe82c5e","message":"Harden claims against clock skew: leases are bounded durations (#18)\n\n* Harden claims against clock skew: leases are bounded durations\n\nA claim's lease was an instant one operator wrote and another compared\nagainst its own clock, which left three exposures. A forward clock jump\nbetween two renewals wrote a lease years out that nobody — including its\nown writer — could retract, because the store adopted a rewrite only when\n`expiresAt` moved forward, the rkey is a pure function of the request, and\nRadial deletes no records. Expiry was evaluated on the reader's clock, so\nthe lease an operator actually honoured was `leaseMs - skew`. And the\nstore's forward-only scan tie-broke on `rev`, which is observer-local.\n\nThe model now: a lease is a DURATION its writer declares, bounded by the\nprotocol, measured by each observer on its own clock.\n\n- `claim.renewedAt` (lexicon, additive and optional): when the writer\n issued this version of the lease. Renewals move it with `expiresAt`\n from one clock reading, so a forward jump changes the duration by\n nothing at all. Absent means `createdAt`, so legacy claims read as\n before and renew across the upgrade in either direction.\n- Two wire-contract constants in `@radial/core`'s `claim-lease.ts`: a\n declared lease of at most 1h, and — for a version with no `renewedAt` —\n an `expiresAt` at most 24h after its own `createdAt`. Both the fold and\n the store refuse a version outside its bound; the fold names it in\n `ignored` and the store files it as a rejected edit.\n- Store selection is a predicate over the version set (latest conforming\n expiry, ties by cid) rather than a forward-only scan. That makes a\n SHORTENING rewrite adoptable exactly when the version it replaces is out\n of contract — the repair path, which the claimant's own daemon takes\n automatically — and refused otherwise, so a live lease still cannot be\n retracted. Without it the clamp would wedge a daemon forever on a\n poisoned record it can neither delete nor shorten.\n- Liveness is the declared duration counted from `firstSeenAt`, a new\n observer-local stamp on `StoredRecord` reconciled like `rev` (minimum\n across provenances), stamped by the poller and the jetstream\n subscription, nullable in all three stores so no migration is needed.\n- `run.claims.leaseMs` above the protocol bound is refused at startup, and\n `radiald run` samples PDS `Date` headers plus future-dated records to\n warn about skew it can measure.\n\nDrills F6-F8 give each operator its own clock: a reader ten minutes fast,\na seven-day forward jump mid-lease and the poisoned record it leaves, and\nthe tie-break a slow clock wins every time — that last one asserting the\nexposure deliberately left open, since hardening it means reintroducing a\ncorroborating time source (docs/adr-claim-leases-are-durations.md §D6).\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Bound every claim version by the horizon, and give claims generations\n\nReview follow-up on the clock-skew hardening.\n\nThe horizon (`expiresAt - createdAt` <= 24h) now applies to every claim\nversion, not only to those written before `renewedAt` existed. `renewedAt`\nis self-reported, so the tight lease bound alone certifies nothing about\nwhere a lease sits: a clock that steps a week forward, renews and is then\ncorrected leaves a version declaring exactly `leaseMs` a week out, in\ncontract, selected over every honest renewal after it until wall time\ncatches up — with no `ignored` entry, no rejected edit and no repair,\nwhile peers stop honouring it one lease after arrival. `createdAt` is the\nonly field on the record that corroborates `renewedAt`.\n\nThat bounds a claim's whole life to a day, and a request can stay open far\nlonger (one waiting on a human answer routinely does), so claim records are\nnow generational: the rkey hashes `requestUri#requestCid` for the first and\n`...#` after it. `ClaimManager` clamps its last renewal to\nexpire exactly at the horizon, retires the claim loudly, and re-claims\nunder the next generation through the ordinary gates. Nothing is deleted,\nno wire rule changes, and a retired claim leaves no diagnostic residue.\n\nAlso from the review:\n\n- The out-of-contract repair is hoisted above the state switch, so it fires\n on a `held` row too — the state an upgrade finds a pre-`renewedAt` clock\n jump in, where nothing else ever would (no renewal is due against a\n year-long lease, and the fold names nobody, so the loss branch is silent\n as well).\n- The `Date`-header skew warning buckets by the measured skew per origin\n instead of by the current clock, which put every tick in its own bucket\n and reprinted the warning every five seconds; the regression test drives\n an advancing clock.\n- `futureDatedAuthors` considers a claim's `renewedAt`, which is where a\n jumped clock shows, since renewal freezes `createdAt` by design.\n- `packages/lexicons/README.md` documents the version-selection rule —\n latest conforming `expiresAt`, ties by lowest cid, never by revision or\n arrival order — which is as load-bearing for interop as the constants.\n\nDrill 7 now asserts that a week-forward jump writes no lease into next\nweek at all; drill 7c covers the horizon retirement end to end. The golden\nscenario's live claims moved from a month old to half a day, which is what\nthe horizon now permits.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Retire a claim its own clock can no longer hold\n\nCloses the three findings on impl-5bufi2nhot77ohwk7sbikszx.\n\nA daemon whose clock steps forward stamps createdAt, renewedAt and\nexpiresAt from that clock, so the record it writes is IN CONTRACT — a\nlegal lease inside a legal horizon. Correct the clock and that record is\nbeyond its own writer and invisible to every recovery path: not lapsed,\nnot due for renewal, not refused by the fold (so no ignored entry and no\nrepair), and unshortenable exactly because it conforms. The row sat\n`held` forever, gating dispatch behind a claim nothing could move.\n\n`claimRetirementReason` (writer-side only, and marked as such — the fold\nmust never compare its clock to a stranger's) asks whether the clock we\nhave now could have written this record. Three answers of no: the\nhorizon has passed, it was created further into our future than one\nlease, or it conforms and expires further ahead than MAX_CLAIM_LEASE_MS.\n`ClaimManager` retires on it wherever it finds it, and the generation\nwalk asks the same question before adopting a record it collides with,\nso a re-claim cannot put the row straight back.\n\nTwo smaller ones alongside:\n\n- A retirement that lands mid-turn is covered again in the same pump: a\n request whose RUNNING turn is ours is exempt from the turn-eligibility\n gate, which otherwise left it visibly free to peers for a whole turn\n timeout with nothing on this daemon able to re-claim it.\n- The generation cap goes on the ledger row, and `selectClaimable` skips\n a row at the cap. Recording it only in the log left the row reselected\n every pump, re-walking to the same dead end through two PDS round\n trips a tick, forever.\n\nDrill 7d walks drill 7 to its normal end (NTP puts the clock back);\nunit coverage for the predicate, the mid-turn re-claim, the cap and the\nledger column. Docs: operators.md §3, design.md §6/§12, ADR D8.\n\npnpm build && pnpm -r test && pnpm lint && pnpm typecheck all pass.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Cover a turn already running, and measure retirement by our own lease\n\nThree findings on the previous turn, all in the claim manager.\n\nThe mid-turn re-claim was defeated by the capacity gate: a covering\nclaim was charged against free turn slots, and at the default\nconcurrency of 1 the running turn it covers IS the only slot. Free turn\ncapacity now binds only candidates that would start a turn; the\noutstanding budget still binds everything, and takes covering claims\nfirst.\n\n`radiald claim reset` promised to start a capped request over and\nre-walked the same sixteen permanent records instead, capping again in\nthe same pump and silently. The row now keeps its generation and raises\nits own ceiling, so the walk resumes at the first generation nothing was\nwritten at.\n\nThe writer-side retirement check measured its third case against the\nprotocol ceiling rather than the configured lease, leaving every forward\njump under an hour to sit `held` — gating dispatch — until the next\nrenewal fell due, over a request every peer had already stopped\nhonouring.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Measure retirement by the reach of our own renewals\n\nA flat minute of slack was tighter than the renewal machinery needs. A record\nleft by a forward jump of Δ repairs itself on the next renewal — due\n`Δ + renewIntervalMs` after the correction — while observers stop honouring it\none declared lease after arrival, so it is only a problem when\n`Δ > leaseMs − renewIntervalMs` (400 s at the defaults). Below that, retiring it\nbought a divergence no peer could see and cost a generation plus, since the\nretired record keeps the earlier `createdAt` and wins our own tie-break until it\nlapses, up to a lease of our own dispatch — paid every time a host steps its\nclock back a couple of minutes.\n\nSo case 3 now measures `claimRetirementReachMs(timing)` —\n`leaseMs + max(jitter, leaseMs − renewIntervalMs)`, with `CLAIM_CLOCK_SLACK_MS`\n(never more than the lease) as the floor for a configuration that renews as late\nas its lease. `claimRetirementReason` takes the writer's timing rather than a\nlone `leaseMs`; both numbers are writer-side, so nothing another operator\nevaluates moves.\n\nAnd a retirement spends its generation as it happens. The row moves to\n`generation + 1`, so the re-claim in the same pump writes there directly instead\nof colliding with the record it just judged past using and reading it back to\nre-derive the same verdict. That also makes retirement the place the generation\ncap can be reached, so the \"leaving it alone\" line is reported from there too —\n`selectClaimable` skips a row at its ceiling, so the walk would never print it.\n\nDrill 7f walks a two-minute correction: nothing retired, nothing rewritten, the\nrow still held and dispatchable, the ordinary renewal repairing the record, and\nB reading A as the holder throughout. Unit coverage for the reach at both\nboundaries and its floor, the band left to self-repair, the re-claim costing no\nread-back, and the cap reported from a retirement.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n---------\n\nCo-authored-by: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) ","tree":"225ec9e26ae9a28c4fcd924c40cbbc3b5f0ce08b"},"mode":"0100644","name":"clock.ts","size":5408},{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-27T15:56:54.000000-07:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-27T15:56:54.000000-07:00"},"hash":"ac5a07742d578fd1aa919bc4e8510899ffe82c5e","message":"Harden claims against clock skew: leases are bounded durations (#18)\n\n* Harden claims against clock skew: leases are bounded durations\n\nA claim's lease was an instant one operator wrote and another compared\nagainst its own clock, which left three exposures. A forward clock jump\nbetween two renewals wrote a lease years out that nobody — including its\nown writer — could retract, because the store adopted a rewrite only when\n`expiresAt` moved forward, the rkey is a pure function of the request, and\nRadial deletes no records. Expiry was evaluated on the reader's clock, so\nthe lease an operator actually honoured was `leaseMs - skew`. And the\nstore's forward-only scan tie-broke on `rev`, which is observer-local.\n\nThe model now: a lease is a DURATION its writer declares, bounded by the\nprotocol, measured by each observer on its own clock.\n\n- `claim.renewedAt` (lexicon, additive and optional): when the writer\n issued this version of the lease. Renewals move it with `expiresAt`\n from one clock reading, so a forward jump changes the duration by\n nothing at all. Absent means `createdAt`, so legacy claims read as\n before and renew across the upgrade in either direction.\n- Two wire-contract constants in `@radial/core`'s `claim-lease.ts`: a\n declared lease of at most 1h, and — for a version with no `renewedAt` —\n an `expiresAt` at most 24h after its own `createdAt`. Both the fold and\n the store refuse a version outside its bound; the fold names it in\n `ignored` and the store files it as a rejected edit.\n- Store selection is a predicate over the version set (latest conforming\n expiry, ties by cid) rather than a forward-only scan. That makes a\n SHORTENING rewrite adoptable exactly when the version it replaces is out\n of contract — the repair path, which the claimant's own daemon takes\n automatically — and refused otherwise, so a live lease still cannot be\n retracted. Without it the clamp would wedge a daemon forever on a\n poisoned record it can neither delete nor shorten.\n- Liveness is the declared duration counted from `firstSeenAt`, a new\n observer-local stamp on `StoredRecord` reconciled like `rev` (minimum\n across provenances), stamped by the poller and the jetstream\n subscription, nullable in all three stores so no migration is needed.\n- `run.claims.leaseMs` above the protocol bound is refused at startup, and\n `radiald run` samples PDS `Date` headers plus future-dated records to\n warn about skew it can measure.\n\nDrills F6-F8 give each operator its own clock: a reader ten minutes fast,\na seven-day forward jump mid-lease and the poisoned record it leaves, and\nthe tie-break a slow clock wins every time — that last one asserting the\nexposure deliberately left open, since hardening it means reintroducing a\ncorroborating time source (docs/adr-claim-leases-are-durations.md §D6).\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Bound every claim version by the horizon, and give claims generations\n\nReview follow-up on the clock-skew hardening.\n\nThe horizon (`expiresAt - createdAt` <= 24h) now applies to every claim\nversion, not only to those written before `renewedAt` existed. `renewedAt`\nis self-reported, so the tight lease bound alone certifies nothing about\nwhere a lease sits: a clock that steps a week forward, renews and is then\ncorrected leaves a version declaring exactly `leaseMs` a week out, in\ncontract, selected over every honest renewal after it until wall time\ncatches up — with no `ignored` entry, no rejected edit and no repair,\nwhile peers stop honouring it one lease after arrival. `createdAt` is the\nonly field on the record that corroborates `renewedAt`.\n\nThat bounds a claim's whole life to a day, and a request can stay open far\nlonger (one waiting on a human answer routinely does), so claim records are\nnow generational: the rkey hashes `requestUri#requestCid` for the first and\n`...#` after it. `ClaimManager` clamps its last renewal to\nexpire exactly at the horizon, retires the claim loudly, and re-claims\nunder the next generation through the ordinary gates. Nothing is deleted,\nno wire rule changes, and a retired claim leaves no diagnostic residue.\n\nAlso from the review:\n\n- The out-of-contract repair is hoisted above the state switch, so it fires\n on a `held` row too — the state an upgrade finds a pre-`renewedAt` clock\n jump in, where nothing else ever would (no renewal is due against a\n year-long lease, and the fold names nobody, so the loss branch is silent\n as well).\n- The `Date`-header skew warning buckets by the measured skew per origin\n instead of by the current clock, which put every tick in its own bucket\n and reprinted the warning every five seconds; the regression test drives\n an advancing clock.\n- `futureDatedAuthors` considers a claim's `renewedAt`, which is where a\n jumped clock shows, since renewal freezes `createdAt` by design.\n- `packages/lexicons/README.md` documents the version-selection rule —\n latest conforming `expiresAt`, ties by lowest cid, never by revision or\n arrival order — which is as load-bearing for interop as the constants.\n\nDrill 7 now asserts that a week-forward jump writes no lease into next\nweek at all; drill 7c covers the horizon retirement end to end. The golden\nscenario's live claims moved from a month old to half a day, which is what\nthe horizon now permits.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Retire a claim its own clock can no longer hold\n\nCloses the three findings on impl-5bufi2nhot77ohwk7sbikszx.\n\nA daemon whose clock steps forward stamps createdAt, renewedAt and\nexpiresAt from that clock, so the record it writes is IN CONTRACT — a\nlegal lease inside a legal horizon. Correct the clock and that record is\nbeyond its own writer and invisible to every recovery path: not lapsed,\nnot due for renewal, not refused by the fold (so no ignored entry and no\nrepair), and unshortenable exactly because it conforms. The row sat\n`held` forever, gating dispatch behind a claim nothing could move.\n\n`claimRetirementReason` (writer-side only, and marked as such — the fold\nmust never compare its clock to a stranger's) asks whether the clock we\nhave now could have written this record. Three answers of no: the\nhorizon has passed, it was created further into our future than one\nlease, or it conforms and expires further ahead than MAX_CLAIM_LEASE_MS.\n`ClaimManager` retires on it wherever it finds it, and the generation\nwalk asks the same question before adopting a record it collides with,\nso a re-claim cannot put the row straight back.\n\nTwo smaller ones alongside:\n\n- A retirement that lands mid-turn is covered again in the same pump: a\n request whose RUNNING turn is ours is exempt from the turn-eligibility\n gate, which otherwise left it visibly free to peers for a whole turn\n timeout with nothing on this daemon able to re-claim it.\n- The generation cap goes on the ledger row, and `selectClaimable` skips\n a row at the cap. Recording it only in the log left the row reselected\n every pump, re-walking to the same dead end through two PDS round\n trips a tick, forever.\n\nDrill 7d walks drill 7 to its normal end (NTP puts the clock back);\nunit coverage for the predicate, the mid-turn re-claim, the cap and the\nledger column. Docs: operators.md §3, design.md §6/§12, ADR D8.\n\npnpm build && pnpm -r test && pnpm lint && pnpm typecheck all pass.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Cover a turn already running, and measure retirement by our own lease\n\nThree findings on the previous turn, all in the claim manager.\n\nThe mid-turn re-claim was defeated by the capacity gate: a covering\nclaim was charged against free turn slots, and at the default\nconcurrency of 1 the running turn it covers IS the only slot. Free turn\ncapacity now binds only candidates that would start a turn; the\noutstanding budget still binds everything, and takes covering claims\nfirst.\n\n`radiald claim reset` promised to start a capped request over and\nre-walked the same sixteen permanent records instead, capping again in\nthe same pump and silently. The row now keeps its generation and raises\nits own ceiling, so the walk resumes at the first generation nothing was\nwritten at.\n\nThe writer-side retirement check measured its third case against the\nprotocol ceiling rather than the configured lease, leaving every forward\njump under an hour to sit `held` — gating dispatch — until the next\nrenewal fell due, over a request every peer had already stopped\nhonouring.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n* Measure retirement by the reach of our own renewals\n\nA flat minute of slack was tighter than the renewal machinery needs. A record\nleft by a forward jump of Δ repairs itself on the next renewal — due\n`Δ + renewIntervalMs` after the correction — while observers stop honouring it\none declared lease after arrival, so it is only a problem when\n`Δ > leaseMs − renewIntervalMs` (400 s at the defaults). Below that, retiring it\nbought a divergence no peer could see and cost a generation plus, since the\nretired record keeps the earlier `createdAt` and wins our own tie-break until it\nlapses, up to a lease of our own dispatch — paid every time a host steps its\nclock back a couple of minutes.\n\nSo case 3 now measures `claimRetirementReachMs(timing)` —\n`leaseMs + max(jitter, leaseMs − renewIntervalMs)`, with `CLAIM_CLOCK_SLACK_MS`\n(never more than the lease) as the floor for a configuration that renews as late\nas its lease. `claimRetirementReason` takes the writer's timing rather than a\nlone `leaseMs`; both numbers are writer-side, so nothing another operator\nevaluates moves.\n\nAnd a retirement spends its generation as it happens. The row moves to\n`generation + 1`, so the re-claim in the same pump writes there directly instead\nof colliding with the record it just judged past using and reading it back to\nre-derive the same verdict. That also makes retirement the place the generation\ncap can be reached, so the \"leaving it alone\" line is reported from there too —\n`selectClaimable` skips a row at its ceiling, so the walk would never print it.\n\nDrill 7f walks a two-minute correction: nothing retired, nothing rewritten, the\nrow still held and dispatchable, the ordinary renewal repairing the record, and\nB reading A as the holder throughout. Unit coverage for the reach at both\nboundaries and its floor, the band left to self-repair, the re-claim costing no\nread-back, and the cap reported from a retirement.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n---------\n\nCo-authored-by: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) ","tree":"225ec9e26ae9a28c4fcd924c40cbbc3b5f0ce08b"},"mode":"0100644","name":"index.ts","size":55},{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-19T10:22:31.000000-07:00"},"committer":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-19T10:22:31.000000-07:00"},"hash":"085379bfb81bb80c01eb08416a9e182319967d0c","message":"drop pds\n","tree":"c8299b7db760cf0e4e7b6250943bd464d42d1714"},"mode":"0100644","name":"node-shims.d.ts","size":1462},{"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-28T11:17:36.000000-07:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-28T11:17:36.000000-07:00"},"hash":"c9396b3e23f2ae081b197b25542727a338fe95b2","message":"make several radiald instances on one machine explicit (#20)\n\nTwo agent identities under one daemon already worked — profiles carry their own\n`identifier`. What was singular was the LOCATION: `new FileSessionStore()` with\nno argument, movable only by `$RADIAL_DATA_DIR`, with `sessions.json` keyed by\nprofile name. Two instances sharing a data directory and reusing a profile name\nclobbered each other silently; the loser then ran under the wrong DID with no\ncomplaint.\n\n- `--data-dir` beside `--config` on every command, and a config-relative\n `\"dataDir\"` in radial.json, so `--config ` alone selects an instance.\n New `instance.ts` owns the precedence (flag → env → config → default) and\n reports when the environment shadowed the file.\n- `run.stateDir` defaults to `/run`, so one setting separates the\n ledgers, index and per-turn directories too.\n- `radiald init` refuses to re-register a profile under a different DID\n (`--replace-identity` overrides); `loadActors` refuses a configured DID that\n does not match its stored session, and warns on a drifted handle or a profile\n with no session.\n- `radiald run` prints the config, data dir, sessions file, state dir and\n instance id it resolved, plus the DID and handle per profile.\n- New `StateDirLock`: one daemon per state directory, enforced by the same\n cross-process SQLite lock the session store uses. `index reset` takes it too.\n- Container labels carry an instance segment, since docker's namespace is\n machine-global — no `--name` collisions, no reconciling away another\n instance's live containers.\n- `radial --data-dir` for the human CLI; docs and CHANGELOG.\n\nNew tests: instance.test.mjs, state-lock.test.mjs, and two-instances.test.mjs —\nthe offline drill with two identities and the same profile names on one machine.\n\nCo-authored-by: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) ","tree":"3401d5c10143e0d4a71e3c6b5849c5487d174524"},"mode":"0100644","name":"node.ts","size":6375}],"lastCommit":{"author":{"email":"tim@disnetdev.com","name":"Tim Disney","when":"2026-07-29T16:58:29.000000-07:00"},"committer":{"email":"noreply@github.com","name":"GitHub","when":"2026-07-29T16:58:29.000000-07:00"},"hash":"9c82b31e7a55266d07bcbf7faa5b4a872ebbf108","message":"Unify goal endings with typed close records (#24)\n\n* Unify goal endings with typed close records\n\nCo-Authored-By: codexbot.disnetdev.com (did:plc:hbonvqr5ysrscg5wdyb5klie) \n\n* Answer the review on the goal-ending change\n\nThe fold no longer lets a legacy `archiveGoal{archived:false}` reopen a goal its\nauthor had closed. `goal.closed` and `archiveGoal` are two independent legacy\ndimensions, so an archive record can only ADD its park; a `closeGoal` — the one\naxis — still decides the state outright in either direction, and a goal carrying\nboth legacy signals reports the closure that actually happened.\n\nAlso from the review:\n\n- The golden scenario now carries all three ending signals on one goal, tied on\n the instant across collections, so the 200-permutation whole-index test covers\n the new record; `archive.test.mjs` becomes `ending.test.mjs` with the fold\n matrix and 100 permutations of its own. The fixture ends a goal each way, so\n demo mode draws every disposition and an `endedAt`.\n- `liveTargets` delegating to `activeGoals()` is stated as the deliberate\n reader-side change it is — docstring, CHANGELOG, and an exact count in\n `verdicts.test.ts` rather than an existence check.\n- Dropping the `archiveGoal` and `goal?action=update` permissions narrows an\n already-issued token's scope, so a scope refusal now says that signing out and\n in again is the fix, and the CHANGELOG says so too.\n- Only `completed` keeps the sage ✓; `dropped`, `superseded`, `parked` and an\n unknown word are `flat`, through one shared `endingBadge`.\n- `--disposition` is refused when the lexicon could not carry it and warned when\n it is outside the documented vocabulary; `goal unarchive` no longer writes a\n `parked` annotation onto a reopen.\n- The disposition picker is a styled `select.sl` with a paired label.\n- `isClosed`, `ownsGoal` and `RepoWriteAction`'s unreachable `'update'` are gone.\n- design.md §4/§7/§12 specify the new model and name what it supersedes;\n phase6-ui-plan §3.5 and its 6.7 note are marked superseded; the stale\n \"two endings\"/\"sanctioned owner edit\" comments across core, atproto, sidecar,\n daemon and the UI now describe the model in the tree.\n\nCo-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) \n\n---------\n\nCo-authored-by: codexbot.disnetdev.com (did:plc:hbonvqr5ysrscg5wdyb5klie) \nCo-authored-by: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) ","tree":"bb4cc6586eaf53c487c484edf786baabb50e9312"}}