수정: 저널 공유 저장소 유실 차단

Runtime과 directory별 coordinator가 commit, recover, pack, prune, delete를 정렬한다.
주소 cache는 존재를 재확인하는 hint가 되고 delete epoch가 모든 facade에 전파된다.
검증: npm test 3595/3595, test:types, test:contracts, test:browser 137/137

Author: eddmpython

docs/operations/contractReality.md

@@ -9,7 +9,6 @@ It is consulted whenever the engine version moves or a capability changes.
 
 | Item | Contract | Actual | Next action |
 |---|---|---|---|
-| Intermittent journal commit loss across controllers | A successful commit whose ID is installed as HEAD recovers the exact heap, and later pack or prune keeps every object reachable from it | The Edge release gate once installed the expected branch commit as HEAD but recovered without the just-written `jbr` value. Its following `pack()` then reported a missing blob. The same revision passed before and after that run, and the existing `stateKernel` probe has not made the failure deterministic. The failing path creates multiple `MachineJournal` controllers over one Runtime and directory, while those controllers share the reactive heap but keep separate address caches and operation guards | Turn the multi-controller cache and storage race into a deterministic negative gate, define one coordination invariant per Runtime and directory, then remove this row only after repeated Edge stress and the full release gate pass |
 | A replay worker keeps a second copy of its own heap | `N` interpreters cost `N` heaps | A replay-booted worker holds `cp0`, a full byte copy of its heap, so a pool of `N` costs `2N` heaps. Two consumers need it: harvest (which only needs the changed page numbers) and drift cleanup (which needs the original bytes). Harvest could run on page hashes at 8 bytes per page instead, but that lowers the fork verdict from byte equality to a 64-bit collision probability, and the reactive path accepting that trade does not make the fork path accept it. The word-wise comparison landed first and cut the time cost of the same scan to about a quarter, so what remains is purely the memory multiple | Decide whether the fork and reactive paths should share one verdict strength. That is a product decision about correctness posture, not a refactor, and it belongs to whoever opens it deliberately |
 | The boot snapshot is made on the main thread | Booting a pool does not block the page | `_makeSnapshot` boots a whole extra Pyodide on the main thread and copies the snapshot into a SharedArrayBuffer, so pool creation carries one main-thread long task plus a global engine load. Moving it into a dedicated worker would remove both, but the worker kernel header records a measured fact that forbids assuming it is equivalent: a main kernel and a worker kernel do not replay to the same bytes | Measure first: prove a snapshot made in a worker is byte-identical to one made on the main thread, in `tests/attempts/runtimeParity`. Only then move it |
 | The global patch window costs boot concurrency | Two machines boot independently | The default boot always carries a core trust anchor, so it always opens the core-asset cache window, and that window is a single tab-wide chain because it swaps `globalThis.fetch`. Two concurrent `boot()` calls therefore overlap only partially: the browser gate measures 1.59x the single-boot wall clock for two at once (2.0x would be fully serial, 1.0x fully parallel). The window is not removable as-is - it exists because two concurrent global swaps restore each other's patch - so the cost is a property of the fetch-interception design, not a defect to patch away | Either intercept core-asset fetches without a global swap (an engine-level loader hook), or accept the cost and keep it measured. The gate records the ratio on every run so a regression toward 2.0x is visible |

docs/reference/api.md

@@ -335,6 +335,12 @@ The WAL engine under `machine.history`'s durable verbs, constructed via
 success/failure (`PYPROC_JOURNAL_IO`); `cfg.autoPack` packs past a loose-blob threshold;
 `cfg.pruneAfterCommit` trims the checkpoint tree each commit.
 
+All journal facades created from the same Runtime and directory-handle object form one coordination
+domain. Commit, recover, branch, adopt, pack, prune, and delete are ordered through that domain;
+page-address hints and storage-handle invalidation are shared. This closes races inside one Runtime.
+A raw journal spanning tabs still needs an elected owner; the durable machine provides that owner
+through its existing lock and fence contract.
+
 A successful commit writes `journalMarker.json` only after HEAD is complete. If that committed
 marker remains while HEAD and PREV are both absent, `recover()` raises
 `PYPROC_JOURNAL_EVICTED` instead of impersonating a fresh machine. `delete()` removes the backing

index.d.ts

@@ -700,7 +700,7 @@ declare class Init {
 }
 
 export interface JournalConfig {
-  /** Directory the journal lives in (OPFS or similar). The caller supplies it. */
+  /** Directory the journal lives in (OPFS or similar). Facades using the same Runtime and handle share one coordination domain. */
   dir: FileSystemDirectoryHandle;
   /** Controller whose cp0 is the replay boundary (the reactive from bootSession). Required for revival. */
   reactive: ReactiveController;
@@ -797,6 +797,8 @@ export interface JournalRecoverResult {
  * survives even when a hibernate hook fails.
  * The contract: a crash loses everything "since the last commit". That is boundary consistency,
  * not per-statement durability.
+ * Every facade created from one Runtime and directory handle shares operation ordering, address
+ * cache lifetime, and storage invalidation. A raw journal used across tabs still needs one owner.
  */
 declare class MachineJournal {
   readonly commits: number;

mainPlan/recoverableAutomationComputer/README.md

@@ -50,6 +50,12 @@ pyproc을 브라우저 탭 안의 Python 실행기에서, 여러 guest와 자동
 | 7 | v86 browser probe | cold/warm boot, heap, 첫 화면, 입력, network, screenshot 수치 | 제품 최소선 충족 시 provider 후보 계약, 미달 시 명시적 경계 문서 |
 | 8 | 제품 졸업 | 설치물 양쪽 언어 여정, 전체 Node/브라우저/type 게이트, 계약 현실표 정리 | attempts 제거, 현재 문서 갱신, 이 이니셔티브 폴더 삭제 |
 
+## 현재 실행 위치
+
+- 단계 0 완료: 결정적 RED를 거쳐 Runtime+directory coordination domain, 주소 hint 존재 대조,
+  storage epoch 공유를 구현했다. 정식 Edge 게이트 137/137과 Node 게이트 3595/3595가 통과했다.
+- 단계 1 진행: Control Protocol의 wire fixture와 음성 시험부터 시작한다.
+
 ## 제품 최소선
 
 - 첫 명령부터 오류까지 request ID와 space ID로 추적 가능하다.
@@ -62,6 +68,6 @@ pyproc을 브라우저 탭 안의 Python 실행기에서, 여러 guest와 자동
 
 ## 외부 제품 검증
 
-기존 `xlpod`와 `codaro` 점검 기록은 provider 구현의 사용자 여정 입력으로 사용한다. pyproc에서 고쳐야
-하는 결함은 이 이니셔티브에서 구현하고, 각 제품이 소유한 GUI와 학습 흐름 개선은 해당 저장소의
-계획 문서에만 남긴다. 다른 저장소를 pyproc 구현의 우회 경로로 수정하지 않는다.
+기존 외부 제품 점검 기록은 provider 구현의 사용자 여정 입력으로 사용한다. pyproc에서 고쳐야 하는
+결함은 이 이니셔티브에서 구현하고, 각 제품이 소유한 GUI와 학습 흐름 개선은 해당 저장소의 계획
+문서에만 남긴다. 다른 저장소를 pyproc 구현의 우회 경로로 수정하지 않는다.

src/capabilities/journal/journalCoordinator.js

@@ -0,0 +1,74 @@
+// journalCoordinator.js - Layer 2: Runtime과 저널 디렉터리 하나의 연산 순서와 캐시 수명.
+//
+// Reactive heap은 Runtime당 하나다. 같은 Runtime과 directory handle을 쓰는 여러 journal
+// facade가 독립 lock과 주소 cache를 가지면 한쪽 pack이 지운 주소를 다른 쪽 commit이 다시
+// 단언하거나, recover가 commit의 lazy page 복사 중 heap을 바꿀 수 있다. 이 coordinator가
+// heap, ref, CAS를 만지는 연산을 한 줄로 세우고 주소 cache와 storage epoch를 함께 소유한다.
+
+import { PyProcError } from "../../runtime/errors.js";
+
+const RUNTIME_COORDINATORS = new WeakMap();
+
+class JournalCoordinator {
+  constructor(reactive) {
+    this.reactive = reactive || null;
+    this.addressCache = new Map();
+    this.storageEpoch = 0;
+    this._tail = Promise.resolve();
+    this._pending = 0;
+  }
+
+  assertReactive(reactive) {
+    if (!this.reactive) this.reactive = reactive || null;
+    if (reactive && this.reactive !== reactive) {
+      throw new PyProcError(
+        "PYPROC_INPUT_INVALID",
+        "journal: one Runtime and directory must share one ReactiveController",
+      );
+    }
+  }
+
+  get busy() { return this._pending > 0; }
+
+  run(operation) {
+    this._pending++;
+    const result = this._tail.then(async () => {
+      try { return await operation(); }
+      finally { this._pending--; }
+    });
+    // 실패한 작업도 다음 작업의 줄을 끊지 않는다. 오류는 result를 받은 호출자에게만 전달한다.
+    this._tail = result.then(() => undefined, () => undefined);
+    return result;
+  }
+
+  async settle() { await this._tail; }
+
+  invalidateAddresses() { this.addressCache.clear(); }
+
+  resetStorage() {
+    this.addressCache.clear();
+    this.storageEpoch++;
+    return this.storageEpoch;
+  }
+}
+
+export function journalCoordinatorFor(rt, dir, reactive) {
+  // cfg 검증은 MachineJournal.start가 소유한다. 불완전한 수동 구성은 공유할 key가 없으므로
+  // 독립 coordinator를 받고, 실제 연산 전에 기존과 같은 입력 오류가 난다.
+  if (!rt || !dir || (typeof dir !== "object" && typeof dir !== "function")) {
+    return new JournalCoordinator(reactive);
+  }
+  let byDirectory = RUNTIME_COORDINATORS.get(rt);
+  if (!byDirectory) {
+    byDirectory = new WeakMap();
+    RUNTIME_COORDINATORS.set(rt, byDirectory);
+  }
+  let coordinator = byDirectory.get(dir);
+  if (!coordinator) {
+    coordinator = new JournalCoordinator(reactive);
+    byDirectory.set(dir, coordinator);
+  } else {
+    coordinator.assertReactive(reactive);
+  }
+  return coordinator;
+}