the engine owns a run: lock, log, run id, claims

1 files changed, 19 insertions, 73 deletions

diff --git a/cmd/krino/sort.go b/cmd/krino/sort.go
index aeeb1d4..4c0a0d8 100644
--- a/cmd/krino/sort.go
+++ b/cmd/krino/sort.go
@@ -18,8 +18,6 @@ import (
 	"golang.org/x/term"
 
 	"krino/internal/engine"
-	"krino/internal/journal"
-	"krino/internal/lock"
 	"krino/internal/plan"
 	"krino/internal/scan"
 	"krino/internal/xdg"
@@ -50,8 +48,8 @@ const zeroOutcome = "0 applied · 0 failed · 0 declined"
 
 // cmdSort plans and, from Task 7, applies the included directories: flags
 // are checked before any config is read, a bad config stops the whole run
-// before scanning (spec §11), and one journal.Writer, run id and
-// plan.Claims cover every directory in the run. See docs/design.md
+// before scanning (spec §11), and one engine.Session - its log, run id and
+// claims - covers every directory in the run. See docs/design.md
 // §8.2-§8.4 and §11 for the flow this follows.
 func cmdSort(g *globals, names []string, stdout, stderr io.Writer) int {
 	if g.yes && g.dry {
@@ -96,39 +94,25 @@ func cmdSort(g *globals, names []string, stdout, stderr io.Writer) int {
 	stopSignals := installSignalHandler(cancel)
 	defer stopSignals()
 
-	// Ruling 2: journal.Open creates $XDG_STATE_HOME/krino/ and an empty
-	// krino.log as a side effect of merely being called, so a dry run must
-	// never call it at all - not open it and clean up afterwards. -n is
-	// known from the flags before the loop starts, so the gate is exactly
-	// that, nothing per-directory. One Writer and one run id cover every
-	// directory in the run (Task 5's undo depends on a single run id
-	// spanning all of them).
-	var j *journal.Writer
-	var run string
-	if !g.dry {
-		var err error
-		j, err = journal.Open(e.Config.LogFile())
-		if err != nil {
-			fmt.Fprintf(stderr, "krino: %v\n", err)
-			return 1
-		}
-		defer func() {
-			if cerr := j.Close(); cerr != nil {
-				fmt.Fprintf(stderr, "krino: %v\n", cerr)
-			}
-		}()
-		run = journal.NewRunID(e.Now())
+	// The run itself - the log, its run id and the claims every directory
+	// shares - belongs to the engine, so the GUI runs a directory exactly
+	// as this does (GUI design §1.3). Ruling 2: a dry session opens no log,
+	// since journal.Open creates the state directory and an empty krino.log
+	// merely by being called.
+	sess, err := e.NewSession(g.dry)
+	if err != nil {
+		fmt.Fprintf(stderr, "krino: %v\n", err)
+		return 1
 	}
+	defer func() {
+		if cerr := sess.Close(); cerr != nil {
+			fmt.Fprintf(stderr, "krino: %v\n", cerr)
+		}
+	}()
 
 	exit := 0
 	printed := false
 	jsonDirs := []plan.JSONDir{} // never nil: the document's "dirs" must marshal as [], not null
-	// A3: in a dry run one Claims is shared across every directory's Plan
-	// call below, so two directories that both plan a move to the same
-	// destination resolve the collision at planning time instead of each
-	// independently believing it owns that path. A real run applies each
-	// directory before planning the next and starts fresh claims after it.
-	claims := plan.NewClaims()
 
 	for _, d := range e.Dirs {
 		// Spec §3/§11: a second krino on the same directory waits for the
@@ -137,7 +121,7 @@ func cmdSort(g *globals, names []string, stdout, stderr io.Writer) int {
 		// is not unbounded in practice (fix round 2026-09-12/item 1): a
 		// signal cancels it and Acquire returns ctx.Err() promptly instead
 		// of polling forever.
-		l, err := lock.Acquire(ctx, e.Config.LockFile(d.Name), !g.yes)
+		l, err := sess.Lock(ctx, d, !g.yes)
 		if err != nil {
 			if interrupted(err) {
 				// Interrupted while waiting for the lock: an interrupt, not
@@ -151,7 +135,6 @@ func cmdSort(g *globals, names []string, stdout, stderr io.Writer) int {
 			continue
 		}
 
-		var applied []string // where this directory's applied steps put files
 		quit := func() bool {
 			defer func() {
 				if rerr := l.Release(); rerr != nil {
@@ -164,7 +147,7 @@ func cmdSort(g *globals, names []string, stdout, stderr io.Writer) int {
 				exit = 1
 				return false
 			}
-			dp, err := e.Plan(ctx, d, claims)
+			dp, err := sess.Plan(ctx, d)
 			if err != nil {
 				fmt.Fprintf(stderr, "krino: skipping %s: %v\n", d.Name, err)
 				exit = 1
@@ -262,30 +245,7 @@ func cmdSort(g *globals, names []string, stdout, stderr io.Writer) int {
 				toApply = &reviewed
 				notReviewed = len(actionable) - len(reviewedChains(actionable, approved))
 			}
-			res, aerr := e.Apply(ctx, toApply, approved, j, run)
-			if res != nil {
-				// Where files ended up: each copy, and the last place a
-				// move or rename put the file - not a path it passed
-				// through and left.
-				for _, fr := range res.Files {
-					final := ""
-					for _, sr := range fr.Steps {
-						switch {
-						case sr.Status != "ok":
-						case sr.Step.Kind == plan.DeletePermanent:
-							final = "" // gone: nothing is left anywhere
-						case sr.Dst == "":
-						case sr.Step.Kind == plan.Copy:
-							applied = append(applied, sr.Dst)
-						default:
-							final = sr.Dst
-						}
-					}
-					if final != "" {
-						applied = append(applied, final)
-					}
-				}
-			}
+			res, aerr := sess.Apply(ctx, toApply, approved)
 			if aerr != nil {
 				// Interrupted mid-apply (fix round 2026-09-12/item 2):
 				// treated exactly like the cancelled lock wait above - not
@@ -310,20 +270,6 @@ func cmdSort(g *globals, names []string, stdout, stderr io.Writer) int {
 		if quit {
 			break
 		}
-		if !g.dry {
-			// This directory is applied (or skipped) now, so the disk is the
-			// truth for the next one: its claims - sources it moved away,
-			// destinations it planned but declined or failed - must not
-			// block a later directory (triage 28i). What it did put
-			// somewhere stays claimed, so a later (on-conflict overwrite)
-			// takes a free name rather than trash this run's own result
-			// (plan 11 review M1). A dry run applies nothing, so there every
-			// claim carries over.
-			claims = plan.NewClaims()
-			for _, p := range applied {
-				claims.Claim(p)
-			}
-		}
 	}
 
 	if g.json {