feat(daemon): add managed allocation operation journal

[thymikee]

Summary

Share one host-kit durable file publication seam between durable capture envelopes and managed-allocation records. It owns same-directory exclusive temp creation, configurable mode (default 0600), complete UTF-8 write, file fsync, final-path regular-file/symlink checks, replace or link-exclusive publication, directory sync, descriptor/temp cleanup, and primary-error preservation. Allocation reads use host-kit identity-verified descriptors and preserve missing versus corrupt/unreadable outcomes.

The allocation journal is localized under src/daemon/managed-device-allocation/ with journal.ts, record.ts, transitions.ts, decision.ts, and store.ts as caller-facing seams; no barrel was added. The two duplicated durable writers are gone. Simlock allocation/capacity/provisioning/health/lifecycle ownership remains untouched; directory enumeration, record validation, fenced state transitions, and external binding recovery remain domain-specific because they cannot safely use a generic file primitive.

Production allocation journal: 3,075 -> 2,973 lines; durable callers: 326 -> 263 lines. The shared publisher is implemented in the existing host-kit atomic-file owner to preserve import-closure budgets. PR diff: 44 files, +4,430/-63.

Validation

• Exact head: d7b7ebc71f3b637ab7599fa1fe1994f5a2d1160a
• pnpm depgraph affected packages/host-kit/src/file.ts --json ran before host-kit edits.
• Focused suite: 8 files, 56 tests passed.
• Eager-closure budgets: 418 tests passed.
• pnpm check:affected --run: 612 test files and 4,663 tests passed; all runnable checks passed.
• git diff --check is clean; final strict review found no actionable findings.
• No live/device evidence is owed: no production allocation caller changed.

[github-actions]

Size Report

Metric	Base	Current	Diff
JS raw	2.61 MB	2.61 MB	+300 B
JS gzip	878.4 kB	878.5 kB	+96 B
npm bundled raw	2.61 MB	2.61 MB	+300 B
npm bundled gzip	878.4 kB	878.5 kB	+96 B
npm tarball	1.04 MB	1.04 MB	+68 B
npm unpacked	3.52 MB	3.52 MB	+300 B
npm clean-installed	3.52 MB	3.52 MB	+300 B

npm unpacked components

Component	Base	Current	Diff
JS / dist source	2.77 MB	2.77 MB	+300 B
Apple runner source/project	544.4 kB	544.4 kB	0 B
Apple snapshot presentation source	33.8 kB	33.8 kB	0 B
Apple Simulator snapshot bridge source	30.5 kB	30.5 kB	0 B
macOS helper source	54.8 kB	54.8 kB	0 B
Android helper artifacts	43.3 kB	43.3 kB	0 B
Other package files	46.7 kB	46.7 kB	0 B

Startup median (7 runs, lower is better):

Scenario	Base	Current	Diff
CLI --version	29.9 ms	30.5 ms	+0.5 ms
CLI --help	81.7 ms	78.4 ms	-3.3 ms

Top changed chunks:

Chunk	Raw diff	Gzip diff
dist/src/internal/daemon.js	0 B	-2 B

Top changed packed files

Packed file	Base	Current	Diff
dist/src/owner-identity.js	4.2 kB	5.0 kB	+829 B
dist/src/screen-recording-resource-recovery.js	18.8 kB	18.2 kB	-568 B
dist/src/config.js	1.3 kB	1.4 kB	+39 B

[thymikee]

Review at exact head 236be86 is blocked by two durability findings.

(1) P1: publishBinding performs the external publish before persisting binding-published. If publish succeeds and that write fails or the process dies, the record stays unpublished; a later release then skips the cleanup hook for unpublished, marks it cleaned, and releases the allocator lease while a live managed binding/claim may remain. Add a durable pre-publish/uncertain state, reconcile or conservatively run idempotent cleanup, and add a planted-red failure-after-successful-publish test proving allocator release cannot precede cleanup.

(2) P1: listAllocationOperationPaths turns every root readdirSync failure into an empty journal and silently skips every unreadable lane directory. laneConflict treats that as no prior generation, so a read-denied/corrupt journal can fail open and admit a second allocator attempt. Distinguish ENOENT from unreadable state and propagate a blocking unreadable/persistence result; add planted-red root/lane enumeration-failure tests.

The Android smoke failure is an unrelated keyboard-state/cleanup flake and its failed-job rerun is underway. Because this adds 4,078 gross lines across 41 files, update the PR body to itemize justified growth and record why a smaller design or reuse of the existing durable-resource store was rejected, as required by review policy.

[thymikee]

Addressed in 7073315:

• Publication now persists publish-pending before invoking the external binding publisher. A successful publish is recorded separately; if that write is lost, release/recovery conservatively invokes cleanup before allocator release. The planted-red test asserts the observed order is publish → cleanup → release.
• Journal enumeration now distinguishes a missing path (ENOENT) from an unreadable root/lane. Unreadable enumeration becomes a blocking unreadable result instead of an empty lane history. Root and lane failure tests cover the fail-closed behavior and no second allocator request.
• ADR-0021 and the PR body now document the pending-publication invariant and the rationale for the dedicated journal seams.

The prior Android smoke failure was an unrelated keyboard/cleanup flake; its rerun passed. The pushed head is now waiting on the new GitHub checks.

[thymikee]

Re-review complete at exact head 7073315. Both prior P1s are fixed: publication now durably enters publish-pending before the external effect and uncertain release/recovery cleans before allocator release; journal enumeration now distinguishes absence from unreadable root/lane state and fails closed. The planted-red tests cover post-publish persistence loss with exact publish → cleanup → release ordering and root/lane enumeration failure without a second allocator request. Codec, transition, and ADR changes are consistent. The PR body now itemizes the 4,303-line growth and records why the existing durable-resource store and a single-module design were rejected. All exact-head applicable checks are green and no live device evidence is owed because there is no production allocation caller. No remaining code-review finding; ready for human merge.

[thymikee]

Re-reviewed exact head d7b7ebc71f3b637ab7599fa1fe1994f5a2d1160a: code review is clean. The shared durable-file publisher preserves exclusive temp creation, file and directory durability, safe final-path checks, link-exclusive versus replace publication, cleanup, and primary-error preservation. The allocation journal move improves topology without changing fail-closed behavior, and the PR adequately explains the large move-dominated diff and rejected smaller boundaries.

No live managed-allocation evidence is owed because this journal still has no production caller. Exact-head iOS and Android Smoke were still running at review time, so this is code-review ready while those lanes finish.

[thymikee]

Exact-head CI is now fully green, including iOS and Android Smoke. Combined with the completed clean review above, this head is merge-ready.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.
2026-09-05 16:36 UTC