EndoDirectory.move is not atomic when the source and destination are in different name hubs.
packages/daemon/src/directory.js takes the cross-hub path at lines 447-455, writes the destination with storeIdentifier(toPath), and then removes the source with remove(...fromPath).
A process failure between those awaits leaves both names present, while a failure after the destination write but before the source removal leaves a copy rather than an atomic move.
The existing daemon tests cover successful cross-directory moves in packages/daemon/test/endo.test.js (including the host-to-directory and guest-to-guest cases), but do not cover interruption between those two operations.
A Floot session-lifecycle migration test against the real daemon had to retain caller-side recovery for this midpoint: it stages both names, verifies the destination keeps the original locator, and removes the stale source.
Callers should not need to compensate for a non-atomic move.
Please either make cross-directory moves transactional/atomic or expose a primitive whose failure semantics are explicit and safe for durable migrations.
EndoDirectory.moveis not atomic when the source and destination are in different name hubs.packages/daemon/src/directory.jstakes the cross-hub path at lines 447-455, writes the destination withstoreIdentifier(toPath), and then removes the source withremove(...fromPath).A process failure between those awaits leaves both names present, while a failure after the destination write but before the source removal leaves a copy rather than an atomic move.
The existing daemon tests cover successful cross-directory moves in
packages/daemon/test/endo.test.js(including the host-to-directory and guest-to-guest cases), but do not cover interruption between those two operations.A Floot session-lifecycle migration test against the real daemon had to retain caller-side recovery for this midpoint: it stages both names, verifies the destination keeps the original locator, and removes the stale source.
Callers should not need to compensate for a non-atomic move.
Please either make cross-directory moves transactional/atomic or expose a primitive whose failure semantics are explicit and safe for durable migrations.