@animus-ui/extract 0.1.11 → 0.1.12

package/dist/session.cjs

@@ -1,36 +1,25 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_pipeline = require("./pipeline-ojNeABi0.cjs");
+const require_pipeline = require("./pipeline-x1yBZ2UP.cjs");
 let crypto = require("crypto");
 let fs = require("fs");
 let path = require("path");
 //#region session/session-paths.ts
 /**
-* Session-scoped artifact names, path derivations, and the analysis-status
-* shape (openspec: next-turbopack-served-transform-coherence, design D1–D3)
-* — shared by the session writer (extraction-session), the webpack
-* plugin/loader, and the Turbopack loader.
-*
-* Deliberately free of singleton/session imports: the Turbopack loader
-* executes in isolated worker processes and its module graph must stay
-* worker-local (guardrail G1) — this module is pure path/shape vocabulary.
+* Session artifact names, path derivations, and artifact shapes. Imports no
+* session or singleton module: the Turbopack loader graph stays worker-local.
 */
-/** Session-dir-relative name of the replacement-epoch disk witness
-*  (openspec: next-webpack-served-transform-coherence, design D2;
-*  session-scoped by next-turbopack-served-transform-coherence D2). */
+/** Session-dir-relative name of the replacement-epoch disk witness. */
 const REPLACEMENT_EPOCH_ARTIFACT = "replacements-epoch";
-/** Virtual module id of the emitted system-props module — session
-*  vocabulary shared by the orchestrator and the Turbopack config
-*  assembly (hoisted here so the session home stays framework-free). */
+/** Virtual module id of the emitted system-props module. */
 const TURBOPACK_SYSTEM_PROPS_ID = "virtual:animus/system-props";
-/** Session-dir-relative name of the analysis-commit transaction artifact
-*  (design D1). */
+/** Session-dir-relative name of the analysis-commit transaction artifact. */
 const ANALYSIS_COMMIT_ARTIFACT = "analysis-commit";
-/** Session-dir-relative name of the analysis-status artifact (design D3). */
+/** Session-dir-relative name of the analysis-status artifact. */
 const ANALYSIS_STATUS_ARTIFACT = "analysis-status.json";
 /** Session-dir-relative name of the manifest payload artifact. */
 const MANIFEST_ARTIFACT = "manifest.json";
-/** Session-dir-relative name of the analysis-inputs payload artifact
-*  (Turbopack loader-worker hydration corpus). */
+/** Session-dir-relative name of the analysis-inputs payload artifact — the
+*  Turbopack loader-worker hydration corpus. */
 const ANALYSIS_INPUTS_ARTIFACT = "analysis-inputs.json";
 /** Session-dir-relative name of the emitted stylesheet artifact. */
 const STYLES_ARTIFACT = "styles.css";
@@ -38,126 +27,226 @@ const STYLES_ARTIFACT = "styles.css";
 const SYSTEM_PROPS_ARTIFACT = "system-props.js";
 /** Session-dir-relative directory holding copied asset() files. */
 const SESSION_ASSETS_DIR = "assets";
-/** The standalone CLI's published-set commit record, written into the flat
-*  `.animus/` tree (openspec: standalone-extraction-cli D3). Shared here so
-*  the CLI writer and the session's start hygiene agree on ONE name — the
-*  hygiene confinement gate keys on this record, and a renamed literal on
-*  either side would silently re-arm deletion of the CLI's published output. */
+/** The standalone CLI's published-set commit record in the flat `.animus/`
+*  tree; the session's start hygiene keys on this name before deleting. */
 const CLI_COMMIT_ARTIFACT = "commit.json";
-/** The standalone CLI's single-writer advisory lock in the flat `.animus/`
-*  tree. A live holder means a CLI invocation owns that tree right now. */
+/** Advisory claim record (pid plus heartbeat) of whichever directory holds
+*  it; sessions write it into their own tree too, despite the `CLI_` name. */
 const CLI_LOCK_ARTIFACT = "lock.json";
-/** Root of every session-scoped artifact tree for a project. */
+/** Project-relative artifact directory: the CLI's default output tree and
+*  the parent of every session tree. One spelling, or the tree splits. */
+const ANIMUS_ARTIFACT_DIR = ".animus";
+/** Module id the Rust emitter injects, and the alias key both bundlers
+*  register. A literal on purpose: a rename breaks built consumer packages.
+*  The Next plugin's webpack alias harvest skips this exact key, so a change
+*  here is a change in the emitter, both bundler arms and that harvest. */
+const ANIMUS_CSS_MODULE_ID = ".animus/styles.css";
 function sessionsRootDir(rootDir) {
-	return (0, path.join)(rootDir, ".animus", "sessions");
+	return (0, path.join)(rootDir, ANIMUS_ARTIFACT_DIR, "sessions");
 }
-/** One session's artifact directory (design D2: session-scoped trees,
-*  no global pointer). */
 function sessionArtifactDir(rootDir, sessionId) {
 	return (0, path.join)(sessionsRootDir(rootDir), sessionId);
 }
-/** Absolute path of a session's replacement-epoch artifact — the single
-*  derivation shared by the session writer, the webpack plugin's
-*  watch-ignore entry, and both loaders' file dependencies. Takes the
-*  SESSION directory (not the project root) since the artifact was
-*  relocated into the session tree. */
 function replacementEpochPath(sessionDir) {
 	return (0, path.join)(sessionDir, REPLACEMENT_EPOCH_ARTIFACT);
 }
-/** Absolute path of a session's analysis-commit artifact. */
 function analysisCommitPath(sessionDir) {
 	return (0, path.join)(sessionDir, ANALYSIS_COMMIT_ARTIFACT);
 }
-/** Absolute path of a session's analysis-status artifact. */
 function analysisStatusPath(sessionDir) {
 	return (0, path.join)(sessionDir, ANALYSIS_STATUS_ARTIFACT);
 }
-/** Absolute path of a session's manifest artifact. */
 function manifestPath(sessionDir) {
 	return (0, path.join)(sessionDir, MANIFEST_ARTIFACT);
 }
-/** Absolute path of a session's analysis-inputs artifact. */
 function analysisInputsPath(sessionDir) {
 	return (0, path.join)(sessionDir, ANALYSIS_INPUTS_ARTIFACT);
 }
-/** Absolute path of a session's stylesheet artifact. */
 function stylesPath(sessionDir) {
 	return (0, path.join)(sessionDir, STYLES_ARTIFACT);
 }
-/** Absolute path of a session's system-props module artifact. */
 function systemPropsPath(sessionDir) {
 	return (0, path.join)(sessionDir, SYSTEM_PROPS_ARTIFACT);
 }
-/** Splice the session envelope into a JSON-object payload as a leading
-*  `__animusSession` field, byte-preserving the payload's own content
-*  (parse/re-stringify could reformat engine-emitted JSON). */
+/** Splices the envelope in as a leading `__animusSession` field without
+*  re-serializing: parse/re-stringify would reformat engine-emitted JSON. */
 function envelopeJsonArtifact(payload, envelopeJson) {
 	const trimmed = payload.trimStart();
 	if (!trimmed.startsWith("{")) return payload;
 	if (trimmed.slice(1).trimStart().startsWith("}")) return `{"__animusSession":${envelopeJson}}`;
 	return `{"__animusSession":${envelopeJson},${trimmed.slice(1)}`;
 }
-/** Trailing-comment side-band for the CSS artifact (a leading comment
-*  would displace the @layer declaration consumers pin at offset 0). */
+/** Trailing-comment side-band: a leading comment would displace the `@layer`
+*  declaration consumers pin at offset 0. */
 function envelopeCssArtifact(payload, envelopeJson) {
 	return `${payload}\n/* __animusSession ${envelopeJson} */\n`;
 }
-/** Matches the CSS artifact's envelope side-band. */
 const ENVELOPE_CSS_COMMENT_RE = /\/\* __animusSession (\{.*\}) \*\//;
-/** Envelope of a JSON artifact's bytes, or undefined when the artifact
-*  carries none. THROWS on unparseable bytes — callers decide whether a
-*  torn artifact fails closed or degrades. */
+/** Envelope of a JSON artifact's bytes, or undefined when it carries none.
+*  Throws on unparseable bytes; callers decide torn-artifact policy. */
 function readJsonEnvelope(bytes) {
 	return JSON.parse(bytes).__animusSession;
 }
-/** Envelope of the CSS artifact's side-band comment, or undefined when the
-*  side-band is absent. THROWS on an unparseable envelope body. */
+/** Envelope of the CSS side-band comment, or undefined when it is absent.
+*  Throws on an unparseable envelope body. */
 function readCssEnvelope(bytes) {
 	const match = bytes.match(ENVELOPE_CSS_COMMENT_RE);
 	return match ? JSON.parse(match[1]) : void 0;
 }
 //#endregion
 //#region session/published-set.ts
-/**
-* The CLI published-set contract, shared logic (openspec:
-* standalone-extraction-cli D3): ONE implementation of "does this flat
-* artifact set verify against its commit record" and ONE collector for the
-* session's copied asset() files — consumed by the CLI writer
-* (staging/verification) and the session's start hygiene (confinement
-* gate). Two copies of either had already drifted once: the hygiene copy
-* verified payloads as UTF-8 strings while the writer hashed raw bytes, so
-* any asset-carrying set (fonts are not UTF-8) could never verify and a
-* legitimately published set was classified as debris.
-*/
-/**
-* Recompute every payload hash recorded in the directory's commit record
-* and compare — raw bytes on both sides, matching the writer's hashing
-* domain. Returns failure lines; empty means the set verifies. An absent
-* or unparsable record is itself a failure (the record is written LAST, so
-* a torn or aborted publish cannot verify).
-*/
+function isPublishedSetRecord(value) {
+	return Object.prototype.toString.call(value) === "[object Object]";
+}
+function isPublishedSetString(value) {
+	return Object.prototype.toString.call(value) === "[object String]";
+}
+function isPublishedSetNumber(value) {
+	return Object.prototype.toString.call(value) === "[object Number]";
+}
+function decodeCommitRecord(bytes) {
+	let candidate;
+	try {
+		candidate = JSON.parse(bytes);
+	} catch {
+		return null;
+	}
+	if (!isPublishedSetRecord(candidate) || candidate.schema !== 1) return null;
+	const declared = candidate.payloads;
+	if (!isPublishedSetRecord(declared)) return null;
+	const payloads = {};
+	for (const [name, entry] of Object.entries(declared)) {
+		if (!isPublishedSetRecord(entry) || !isPublishedSetString(entry.hash)) return null;
+		payloads[name] = { hash: entry.hash };
+	}
+	return {
+		schema: 1,
+		payloads
+	};
+}
+/** Recompute every recorded payload hash over raw bytes — the writer's own
+*  hashing domain — and return the mismatches; empty means the set verifies. */
 function verifyCommitRecord(dir) {
-	let record;
+	let bytes;
 	try {
-		record = JSON.parse((0, fs.readFileSync)((0, path.join)(dir, CLI_COMMIT_ARTIFACT), "utf-8"));
+		bytes = (0, fs.readFileSync)((0, path.join)(dir, CLI_COMMIT_ARTIFACT), "utf-8");
 	} catch (error) {
 		return [`commit record unreadable: ${String(error)}`];
 	}
-	if (record.schema !== 1 || typeof record.payloads !== "object" || record.payloads === null) return ["commit record is not a schema-1 payload record"];
+	const record = decodeCommitRecord(bytes);
+	if (record === null) return ["commit record is not a schema-1 payload record"];
 	const failures = [];
 	for (const [name, entry] of Object.entries(record.payloads)) try {
-		if (require_pipeline.contentHash((0, fs.readFileSync)((0, path.join)(dir, name))) !== entry?.hash) failures.push(`${name}: bytes do not match the commit record`);
+		if (require_pipeline.contentHash((0, fs.readFileSync)((0, path.join)(dir, name))) !== entry.hash) failures.push(`${name}: bytes do not match the commit record`);
 	} catch (error) {
 		failures.push(`${name}: unreadable (${String(error)})`);
 	}
 	return failures;
 }
-/**
-* Snapshot the session's copied asset() files (sorted by name) — read
-* BEFORE the session tree is disposed. The emitted stylesheet references
-* them as `./assets/<name>`, so every driver must publish them beside its
-* stylesheet or the urls dangle.
-*/
+const CLI_LOCK_HEARTBEAT_INTERVAL_MS = 6e4;
+/** A claim whose heartbeat is older than this has no live holder. Five missed
+*  refreshes: synchronous extraction can block the holder's refresh timer. */
+const CLI_LOCK_STALE_AFTER_MS = 5 * CLI_LOCK_HEARTBEAT_INTERVAL_MS;
+/** Absence of the file — the only read failure that means "no holder".
+*  ENOTDIR joins ENOENT: the path cannot exist under a non-directory. */
+function isMissingFile(error) {
+	return error instanceof Object && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
+}
+function readCliLockRecord(dir) {
+	let bytes;
+	try {
+		bytes = (0, fs.readFileSync)((0, path.join)(dir, CLI_LOCK_ARTIFACT), "utf-8");
+	} catch (error) {
+		if (isMissingFile(error)) return { kind: "none" };
+		throw error;
+	}
+	let candidate;
+	try {
+		candidate = JSON.parse(bytes);
+	} catch {
+		return { kind: "indeterminate" };
+	}
+	if (!isPublishedSetRecord(candidate) || !isPublishedSetNumber(candidate.pid)) return { kind: "indeterminate" };
+	const startedAt = candidate.startedAt;
+	const heartbeatAt = candidate.heartbeatAt;
+	const record = { pid: candidate.pid };
+	if (isPublishedSetString(startedAt)) record.startedAt = startedAt;
+	if (isPublishedSetString(heartbeatAt)) record.heartbeatAt = heartbeatAt;
+	return {
+		kind: "held",
+		record
+	};
+}
+function isPermissionDenied(error) {
+	return error instanceof Object && "code" in error && error.code === "EPERM";
+}
+function isLockHolderAlive(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch (error) {
+		return isPermissionDenied(error);
+	}
+}
+function checkLockLiveness(record) {
+	if (!isLockHolderAlive(record.pid)) return {
+		live: false,
+		reason: `holder pid ${record.pid} is not running`
+	};
+	const beatAt = record.heartbeatAt === void 0 ? NaN : Date.parse(record.heartbeatAt);
+	if (Number.isNaN(beatAt)) return { live: true };
+	const ageMs = Date.now() - beatAt;
+	if (ageMs <= 3e5) return { live: true };
+	return {
+		live: false,
+		reason: `holder pid ${record.pid} is running but its lock heartbeat (${record.heartbeatAt}) is ${Math.round(ageMs / 1e3)}s old, past the ${CLI_LOCK_STALE_AFTER_MS / 1e3}s staleness window — the pid names a different process now`
+	};
+}
+function lockRecordBytes(startedAt) {
+	return JSON.stringify({
+		pid: process.pid,
+		startedAt,
+		heartbeatAt: (/* @__PURE__ */ new Date()).toISOString()
+	});
+}
+const HEARTBEAT_TEMP_PREFIX = ".lock-heartbeat-";
+function holdDirectoryClaim(dir, options = {}) {
+	const startedAt = options.startedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+	const path$9 = (0, path.join)(dir, CLI_LOCK_ARTIFACT);
+	const tempPath = (0, path.join)(dir, `${HEARTBEAT_TEMP_PREFIX}${process.pid}`);
+	const rename = options.write === "rename";
+	let refresh = null;
+	let stopped = false;
+	const stop = () => {
+		stopped = true;
+		if (refresh !== null) clearInterval(refresh);
+		refresh = null;
+	};
+	const stamp = () => {
+		try {
+			if (rename) {
+				(0, fs.writeFileSync)(tempPath, lockRecordBytes(startedAt));
+				(0, fs.renameSync)(tempPath, path$9);
+			} else (0, fs.writeFileSync)(path$9, lockRecordBytes(startedAt));
+		} catch (error) {
+			stop();
+			if (isMissingFile(error)) return;
+			console.error(`[animus] Could not write the directory claim ${path$9}: ${String(error)}`);
+		}
+	};
+	stamp();
+	if (!stopped) {
+		refresh = setInterval(stamp, CLI_LOCK_HEARTBEAT_INTERVAL_MS);
+		refresh.unref?.();
+	}
+	return () => {
+		stop();
+		if (rename) (0, fs.rmSync)(tempPath, { force: true });
+		(0, fs.rmSync)(path$9, { force: true });
+	};
+}
+/** Snapshot the session's copied asset() files, sorted, BEFORE the session
+*  tree is disposed. Drivers publish them beside the emitted stylesheet. */
 function collectSessionAssets(sessionDir) {
 	if (!sessionDir) return [];
 	const dir = (0, path.join)(sessionDir, SESSION_ASSETS_DIR);
@@ -169,12 +258,6 @@ function collectSessionAssets(sessionDir) {
 }
 //#endregion
 //#region session/resolve-packages.ts
-/**
-* Resolve external DS package specifiers to rootDir-relative entry paths.
-* Node-generic (no webpack APIs): Pass 1 walks the consumer's workspaces for
-* matching package names; Pass 2 falls back to `require.resolve`. Specifiers
-* that resolve nowhere are simply omitted (spec: silent skip).
-*/
 function resolvePackagesByName(rootDir, names) {
 	if (names.length === 0) return {};
 	const nameSet = new Set(names);
@@ -190,7 +273,8 @@ function resolvePackagesByName(rootDir, names) {
 				const pkg = JSON.parse((0, fs.readFileSync)((0, path.join)(wsDir, "package.json"), "utf-8"));
 				const name = pkg.name || "";
 				if (nameSet.has(name)) {
-					const entryPath = (0, path.resolve)(wsDir, pkg.main || pkg.module || "index.ts");
+					const main = pkg.main || pkg.module || "index.ts";
+					const entryPath = (0, path.resolve)(wsDir, main);
 					if ((0, fs.existsSync)(entryPath)) {
 						packageMap[name] = (0, path.relative)(rootDir, entryPath);
 						resolved.add(name);
@@ -202,7 +286,8 @@ function resolvePackagesByName(rootDir, names) {
 	for (const name of nameSet) {
 		if (resolved.has(name)) continue;
 		try {
-			packageMap[name] = (0, path.relative)(rootDir, require.resolve(name, { paths: [rootDir] }));
+			const entryPath = require.resolve(name, { paths: [rootDir] });
+			packageMap[name] = (0, path.relative)(rootDir, entryPath);
 		} catch {}
 	}
 	return packageMap;
@@ -210,86 +295,96 @@ function resolvePackagesByName(rootDir, names) {
 //#endregion
 //#region session/singleton.ts
 /**
-* Module-scope singleton for sharing analysis state between the webpack plugin and loader.
-*
-* Uses globalThis to survive the ESM/CJS module boundary: the plugin is loaded via ESM
-* (next.config.ts import) while the loader is loaded by webpack via require(). Without
-* globalThis, each module system gets its own singleton instance.
+* globalThis-backed so the ESM plugin copy and the CJS webpack-loader copy
+* share one store; module scope alone gives each copy its own instance.
 */
 const MANIFEST_KEY = "__animus_manifest_json__";
-const PROMISE_KEY = "__animus_analysis_promise__";
+const ANALYSIS_STARTED_KEY = "__animus_analysis_started__";
 const SHARED_CSS_KEY = "__animus_shared_css__";
 const SHARED_SYSTEM_PROPS_KEY = "__animus_shared_system_props__";
 const SHARED_EXTERNAL_DIRS_KEY = "__animus_external_pkg_dirs__";
 const SHARED_EXTERNAL_ENTRIES_KEY = "__animus_external_source_entries__";
+const ANALYZED_HASHES_KEY = "__animus_analyzed_hashes__";
+const REPLACEMENT_EPOCH_KEY = "__animus_replacement_epoch__";
+const WATCH_TRANSACTION_KEY = "__animus_watch_transaction__";
+const PROCESS_SESSION_ID_KEY = "__animus_process_session_id__";
+const SESSION_ARTIFACT_DIR_KEY = "__animus_session_artifact_dir__";
+const OWNING_WATCH_SESSION_KEY = "__animus_owning_watch_session__";
+const EXCLUSIVE_SESSION_OWNER_KEY = "__animus_exclusive_session_owner__";
+const ENGINE_KEY = "__animus_engine__";
+const V2_ENGINE_KEY = "__animus_v2_engine__";
+const V2_SENT_SOURCES_KEY = "__animus_v2_sent_sources__";
+const V2_DRIFT_WARNED_KEY = "__animus_v2_drift_warned__";
+const ENGINE_API_OVERRIDE_KEY = "__animus_engine_api_override__";
+const singletonStore = globalThis;
+const isSingletonString = (value) => {
+	if (Object(value) === value) return false;
+	try {
+		String.prototype.valueOf.call(value);
+		return true;
+	} catch {
+		return false;
+	}
+};
 function getManifestJson() {
-	return globalThis[MANIFEST_KEY];
+	return singletonStore[MANIFEST_KEY];
 }
 function setManifestJson(json) {
-	globalThis[MANIFEST_KEY] = json;
+	singletonStore[MANIFEST_KEY] = json;
 }
-function getAnalysisPromise() {
-	return globalThis[PROMISE_KEY];
+/**
+* A latch over the most recently STARTED analysis, never cleared on settle:
+* non-null means one was scheduled. In-flight lives in getWatchTransaction.
+*/
+function getAnalysisStartedPromise() {
+	return singletonStore[ANALYSIS_STARTED_KEY];
 }
-function setAnalysisPromise(promise) {
-	globalThis[PROMISE_KEY] = promise;
+function setAnalysisStartedPromise(promise) {
+	singletonStore[ANALYSIS_STARTED_KEY] = promise;
 }
-function resetAnalysisPromise() {
-	globalThis[PROMISE_KEY] = null;
+function resetAnalysisStartedPromise() {
+	singletonStore[ANALYSIS_STARTED_KEY] = null;
 }
 function getSharedCss() {
-	return globalThis[SHARED_CSS_KEY] || "";
+	return singletonStore[SHARED_CSS_KEY] || "";
 }
 function setSharedCss(css) {
-	globalThis[SHARED_CSS_KEY] = css;
+	singletonStore[SHARED_CSS_KEY] = css;
 }
 function getSharedSystemProps() {
-	return globalThis[SHARED_SYSTEM_PROPS_KEY] || "";
+	return singletonStore[SHARED_SYSTEM_PROPS_KEY] || "";
 }
 function setSharedSystemProps(content) {
-	globalThis[SHARED_SYSTEM_PROPS_KEY] = content;
+	singletonStore[SHARED_SYSTEM_PROPS_KEY] = content;
 }
 function getSharedExternalDirs() {
-	return globalThis[SHARED_EXTERNAL_DIRS_KEY] || [];
+	return singletonStore[SHARED_EXTERNAL_DIRS_KEY] || [];
 }
 function setSharedExternalDirs(dirs) {
-	globalThis[SHARED_EXTERNAL_DIRS_KEY] = dirs;
+	singletonStore[SHARED_EXTERNAL_DIRS_KEY] = dirs;
 }
 function getSharedExternalEntries() {
-	return globalThis[SHARED_EXTERNAL_ENTRIES_KEY] || /* @__PURE__ */ new Map();
+	return singletonStore[SHARED_EXTERNAL_ENTRIES_KEY] || /* @__PURE__ */ new Map();
 }
 function setSharedExternalEntries(entries) {
-	globalThis[SHARED_EXTERNAL_ENTRIES_KEY] = entries;
+	singletonStore[SHARED_EXTERNAL_ENTRIES_KEY] = entries;
 }
-/** One typed globalThis slot — the single accessor shape every
-*  singleton-published value shares (null when unset). */
 function globalSlot(key) {
-	const store = globalThis;
 	return {
-		get: () => store[key] ?? null,
+		get: () => singletonStore[key] ?? null,
 		set: (value) => {
-			store[key] = value;
+			singletonStore[key] = value;
 		}
 	};
 }
-const ANALYZED_HASHES_KEY = "__animus_analyzed_hashes__";
-const REPLACEMENT_EPOCH_KEY = "__animus_replacement_epoch__";
-const WATCH_TRANSACTION_KEY = "__animus_watch_transaction__";
-const PROCESS_SESSION_ID_KEY = "__animus_process_session_id__";
-const SESSION_ARTIFACT_DIR_KEY = "__animus_session_artifact_dir__";
-const OWNING_WATCH_SESSION_KEY = "__animus_owning_watch_session__";
-const EXCLUSIVE_SESSION_OWNER_KEY = "__animus_exclusive_session_owner__";
 const analyzedHashesSlot = globalSlot(ANALYZED_HASHES_KEY);
 const replacementEpochSlot = globalSlot(REPLACEMENT_EPOCH_KEY);
 const watchTransactionSlot = globalSlot(WATCH_TRANSACTION_KEY);
 const sessionArtifactDirSlot = globalSlot(SESSION_ARTIFACT_DIR_KEY);
 const owningWatchSessionSlot = globalSlot(OWNING_WATCH_SESSION_KEY);
 /**
-* The session that completed the full pipeline and holds system state — the
-* only instance that can run watch analysis. Each MultiCompiler child holds
-* its own session AND its own watcher with its own modified set; a
-* non-owning session forwards its batch here instead of dropping it (a file
-* only that compiler watches would otherwise never be analyzed).
+* The only session that can run watch analysis. A non-owning session forwards
+* its batch here; dropping it loses files only that watcher sees.
 */
 function getOwningWatchSession() {
 	return owningWatchSessionSlot.get();
@@ -298,12 +393,8 @@ function setOwningWatchSession(session) {
 	owningWatchSessionSlot.set(session);
 }
 /**
-* Per-file analyzed content hashes of the last published analysis (relPath →
-* contentHash of the exact bytes analyzed) — the loader's witness for the
-* unconditional catching-up guard (openspec:
-* next-webpack-served-transform-coherence, design D4). Includes files
-* analyzed with ZERO animus entries: analyzed identity is membership in the
-* analysis input set, not manifest entry count.
+* Per-file content hashes of the last published analysis (relPath → hash of
+* the exact bytes analyzed), including files that produced zero entries.
 */
 function getAnalyzedHashes() {
 	return analyzedHashesSlot.get();
@@ -312,52 +403,31 @@ function setAnalyzedHashes(hashes) {
 	analyzedHashesSlot.set(hashes);
 }
 /**
-* Session identity is per Next INVOCATION — one process, however many
-* compiler instances it holds (openspec:
-* next-turbopack-served-transform-coherence, design D2). The first
-* ExtractionSession constructed in a process claims a fresh randomUUID;
-* every later instance (client/server/RSC compilers each construct one)
-* adopts it, so all compilers alias, watch-ignore, and publish ONE
-* session-scoped artifact tree. Separate invocations (`next dev` +
-* `next build` co-writing) are separate processes and therefore separate
-* sessions by construction.
+* Session identity is per process: the first caller claims a fresh id and
+* every later one adopts it, so all compilers share one artifact tree.
 */
 function claimProcessSessionId() {
-	const store = globalThis;
-	const existing = store[PROCESS_SESSION_ID_KEY];
-	if (typeof existing === "string" && existing.length > 0) return existing;
+	const existing = singletonStore[PROCESS_SESSION_ID_KEY];
+	if (isSingletonString(existing) && existing.length > 0) return existing;
 	const fresh = (0, crypto.randomUUID)();
-	store[PROCESS_SESSION_ID_KEY] = fresh;
+	singletonStore[PROCESS_SESSION_ID_KEY] = fresh;
 	return fresh;
 }
 /**
-* Exclusive-ownership claim over the process-global session state — the
-* hard form of the invariant `claimProcessSessionId` documents softly. The
-* shared slots above (manifest, css, artifact dir) plus the one session id
-* mean two CONCURRENT drive loops in one process (a webpack MultiCompiler
-* array config, parallel rollup array builds, two programmatic CLI runs)
-* would share one session directory, overwrite each other's manifests, and
-* delete each other's live trees on dispose. Drivers that run the loop
-* exclusively (the unplugin host) claim for the build's lifetime and
-* release on dispose; SEQUENTIAL claim/release cycles are legal. The Next
-* multi-compiler adoption path stays the non-exclusive default. Throws
-* naming both hosts and the remediation on overlap. The key lives in
-* `SINGLETON_GLOBAL_KEYS`, so per-test global resets clear a leaked claim.
+* Two CONCURRENT drive loops in one process would share one session tree and
+* clobber each other; sequential claim/release cycles are legal.
 */
 function claimExclusiveSessionOwner(label) {
-	const store = globalThis;
-	const active = store[EXCLUSIVE_SESSION_OWNER_KEY];
-	if (typeof active === "string") throw new Error(`[animus] a second Animus host ("${label}") started while "${active}" is still active in this process. The extraction session is process-global (one session tree, one manifest), so concurrent hosts would clobber each other's analysis. Run one Animus-enabled config per process, or make the builds sequential.`);
-	store[EXCLUSIVE_SESSION_OWNER_KEY] = label;
+	const active = singletonStore[EXCLUSIVE_SESSION_OWNER_KEY];
+	if (isSingletonString(active)) throw new Error(`[animus] a second Animus host ("${label}") started while "${active}" is still active in this process. The extraction session is process-global (one session tree, one manifest), so concurrent hosts would clobber each other's analysis. Run one Animus-enabled config per process, or make the builds sequential.`);
+	singletonStore[EXCLUSIVE_SESSION_OWNER_KEY] = label;
 	return () => {
-		if (store[EXCLUSIVE_SESSION_OWNER_KEY] === label) delete store[EXCLUSIVE_SESSION_OWNER_KEY];
+		if (singletonStore[EXCLUSIVE_SESSION_OWNER_KEY] === label) delete singletonStore[EXCLUSIVE_SESSION_OWNER_KEY];
 	};
 }
 /**
-* Absolute session artifact directory of the OWNING session's last
-* publication — the webpack loader's source for the session-scoped epoch
-* dependency path (the loader shares the process with the pipeline; the
-* Turbopack loader instead receives the directory via its options).
+* Absolute artifact directory of the OWNING session's last publication. The
+* Turbopack loader runs out of process and receives it via options instead.
 */
 function getSessionArtifactDir() {
 	return sessionArtifactDirSlot.get();
@@ -366,14 +436,8 @@ function setSessionArtifactDir(dir) {
 	sessionArtifactDirSlot.set(dir);
 }
 /**
-* Canonical replacement epoch of the last published analysis
-* (`hashReplacementPlans(snapshotFilePlans(manifest), systemPropsContent)`
-* — openspec: next-webpack-served-transform-coherence, design D5; the
-* served system-props module rides as the served-dependency witness so
-* offline system-props changes move the epoch). Published by the
-* owning session AFTER the manifest so a reader that observes the epoch
-* always observes at least that generation's manifest. (Session
-* attribution lives on the DISK epoch artifact — no in-process mirror.)
+* Replacement epoch of the last published analysis, written AFTER the
+* manifest so an epoch reader always sees at least that generation's manifest.
 */
 function getReplacementEpoch() {
 	return replacementEpochSlot.get();
@@ -382,10 +446,8 @@ function setReplacementEpoch(epoch) {
 	replacementEpochSlot.set(epoch);
 }
 /**
-* The one in-flight watch-analysis transaction (design D3): the first
-* compiler entering a watch batch runs analysis + publication; every other
-* compiler (client/server/RSC — each holds its own session instance) joins
-* this promise instead of proceeding against a pre-transaction generation.
+* The one in-flight watch-analysis transaction: a compiler that did not start
+* it joins this promise rather than read a pre-transaction generation.
 */
 function getWatchTransaction() {
 	return watchTransactionSlot.get();
@@ -393,69 +455,49 @@ function getWatchTransaction() {
 function setWatchTransaction(transaction) {
 	watchTransactionSlot.set(transaction);
 }
-const ENGINE_KEY = "__animus_engine__";
-/** Engine selection travels through the singleton so non-owning compiler
-*  instances and the webpack loader honor the same choice as the owner. */
+/** Engine selection travels through the singleton so non-owning compilers
+*  and the webpack loader honor the owner's choice. */
 function setSharedEngine(engine) {
-	globalThis[ENGINE_KEY] = engine;
+	singletonStore[ENGINE_KEY] = engine;
 }
 function getSharedEngine() {
-	return globalThis[ENGINE_KEY] || "v2";
+	return singletonStore[ENGINE_KEY] || "v2";
 }
-/** Single engine choke-point for every native extraction call. Return type
-*  mirrors the untyped `require` the call sites previously used — the NAPI
-*  module's own .d.ts is the authoritative surface. */
+/** Single choke-point for every native extraction call; the NAPI module's
+*  own `.d.ts` is the authoritative surface for what it returns. */
 function requireEngine() {
 	return require("@animus-ui/extract");
 }
-const V2_ENGINE_KEY = "__animus_v2_engine__";
 /**
-* Engine-agnostic API over both engines (extract-v2-spine row 13). The
-* v2 leg adapts the v1 function surface onto a stateful ExtractEngine
-* (hoisted to `createV2EngineApi` in @animus-ui/extract/pipeline — the
-* single authoritative copy shared with vite-plugin). The engine INSTANCE,
-* its analyze-time sources, and the one-shot drift flag all live on
-* globalThis for the same reason the manifest does — the ESM plugin and the
-* CJS webpack loader must see one engine (and one drift warning) across the
-* double-load. (The next-plugin is already process-singleton by design:
-* manifest, css, and system props share the same globalThis keys.)
-* loadSystemModule is exported by both bindings from one engine-neutral
-* Rust crate, so the default path no longer loads the v1 binary.
+* The one engine API for this process: the instance, its analyze-time
+* sources, and the drift flag live on globalThis so both copies share them.
 */
-const V2_SENT_SOURCES_KEY = "__animus_v2_sent_sources__";
-const V2_DRIFT_WARNED_KEY = "__animus_v2_drift_warned__";
 const v2EngineApi = require_pipeline.createV2EngineApi({
 	label: "animus",
 	isV2: () => getSharedEngine() === "v2",
 	loadNativeEngine: requireEngine,
 	passThroughUnknownPaths: true,
 	store: {
-		getEngine: () => globalThis[V2_ENGINE_KEY],
+		getEngine: () => singletonStore[V2_ENGINE_KEY],
 		setEngine: (engine) => {
-			globalThis[V2_ENGINE_KEY] = engine;
+			singletonStore[V2_ENGINE_KEY] = engine;
 		},
-		getSentSources: () => globalThis[V2_SENT_SOURCES_KEY] ?? null,
+		getSentSources: () => singletonStore[V2_SENT_SOURCES_KEY] ?? null,
 		setSentSources: (sources) => {
-			globalThis[V2_SENT_SOURCES_KEY] = sources;
+			singletonStore[V2_SENT_SOURCES_KEY] = sources;
 		},
-		getDriftWarned: () => Boolean(globalThis[V2_DRIFT_WARNED_KEY]),
+		getDriftWarned: () => Boolean(singletonStore[V2_DRIFT_WARNED_KEY]),
 		setDriftWarned: (value) => {
-			globalThis[V2_DRIFT_WARNED_KEY] = value;
+			singletonStore[V2_DRIFT_WARNED_KEY] = value;
 		}
 	}
 });
-const ENGINE_API_OVERRIDE_KEY = "__animus_engine_api_override__";
 function engineApi() {
-	const override = globalThis[ENGINE_API_OVERRIDE_KEY];
+	const override = singletonStore[ENGINE_API_OVERRIDE_KEY];
 	return override ? override() : v2EngineApi();
 }
 //#endregion
 //#region session/timing.ts
-/**
-* Verbose build-timing waterfall: JS phases, analysis sub-phases, and the
-* shared Rust phase table. `ANIMUS_TIMING_JSON=1` additionally dumps a
-* machine-readable merged record.
-*/
 function logBuildTimings(bt, rustTiming, log, verbose) {
 	if (!verbose) return;
 	const pad = (label, width) => label + " ".repeat(Math.max(0, width - label.length));
@@ -486,28 +528,14 @@ function logBuildTimings(bt, rustTiming, log, verbose) {
 	if (process.env.ANIMUS_TIMING_JSON === "1") {
 		const merged = {};
 		for (const [k, v] of Object.entries(bt)) merged[`buildStart.${k}`] = v;
-		if (rustTiming) {
-			for (const [k, v] of Object.entries(rustTiming)) if (typeof v === "number") merged[`rust.${k}`] = v;
-		}
+		if (rustTiming) for (const [k, v] of Object.entries(rustTiming)) merged[`rust.${k}`] = v;
 		console.error(`[animus:timing] ${JSON.stringify(merged)}`);
 	}
 }
 //#endregion
 //#region session/extraction-session.ts
-/**
-* Module id the Rust emitter injects for the extracted stylesheet — also the
-* exact resolve.alias key with-animus registers for it, which the adapter's
-* alias harvesting must skip.
-*/
-const ANIMUS_CSS_MODULE_ID = ".animus/styles.css";
-/** Retention window for sibling session directories (design D2). */
-const SESSION_DIR_MAX_AGE_MS = 1440 * 60 * 1e3;
-/** Watchdog added to the debounce ceiling for status deadlines (D3). */
+const SESSION_DIR_MAX_AGE_MS = 864e5;
 const STATUS_WATCHDOG_MS = 2e3;
-/** Flat legacy `.animus/` artifacts removed at session start — unreachable
-*  by session-scoped loaders. The standalone CLI still publishes the three
-*  payload names flat; its verified/live sets are fenced off inside
-*  `runSessionStartHygiene`. */
 const LEGACY_FLAT_ARTIFACTS = [
 	MANIFEST_ARTIFACT,
 	ANALYSIS_INPUTS_ARTIFACT,
@@ -517,22 +545,16 @@ const LEGACY_FLAT_ARTIFACTS = [
 	ANALYSIS_COMMIT_ARTIFACT,
 	ANALYSIS_STATUS_ARTIFACT
 ];
-/**
-* Bundler-agnostic extraction pipeline: system loading, source discovery
-* and ingestion, external-package collection, analysis, stylesheet and
-* system-props emission, and watch-cycle diffing.
-*
-* The webpack adapter (plugin.ts) owns only bundler wiring: hook
-* registration, alias harvesting from the compiler config, in-memory asset
-* replacement, and translating watch events into `handleWatchUpdate`
-* change sets. Keeping this class free of webpack types is deliberate — a
-* future Turbopack integration must drive the same session from outside
-* the bundler (Turbopack has no compiler-hook surface), reusing everything
-* here unchanged.
-*
-* Outputs are published through the package singleton (shared CSS,
-* manifest, system props) and written to `.animus/` on disk.
-*/
+/** Brands values read back off DISK. `Object(value) !== value` rejects
+*  boxed primitives; the tag is unspoofable by `Symbol.toStringTag`. */
+function isDiskString(value) {
+	return Object(value) !== value && Object.prototype.toString.call(value) === "[object String]";
+}
+function isDiskNumber(value) {
+	return Object(value) !== value && Object.prototype.toString.call(value) === "[object Number]";
+}
+/** Bundler-agnostic extraction pipeline: system load, source ingestion,
+*  analysis, emission, and watch-cycle diffing. Carries no bundler types. */
 var ExtractionSession = class {
 	/** Set by the adapter before any pipeline run. */
 	rootDir = null;
@@ -542,19 +564,13 @@ var ExtractionSession = class {
 	/** Physical asset files registered with the host watcher. */
 	assetDependencyPaths = /* @__PURE__ */ new Set();
 	assetDependencyKeys = /* @__PURE__ */ new Set();
-	/** Emitter identity override for the system-props module id. Webpack mode
-	*  (null) injects the absolute `.animus/system-props.js` path, resolved by
-	*  NormalModuleReplacement; Turbopack rejects absolute-path imports, so
-	*  its driver sets the virtual id that `resolveAlias` maps to disk. */
+	/** System-props module id override. Turbopack rejects absolute-path
+	*  imports, so its driver sets a virtual id; null injects the abs path. */
 	systemPropsModuleId = null;
-	/** Whether the analysis-inputs hydration corpus is serialized + written.
-	*  False (webpack mode): the loader shares the pipeline process and reads
-	*  the manifest from memory — the corpus is never persisted. True is set
-	*  by the Turbopack orchestration driver, whose isolated loader workers
-	*  replay it (spec: next-turbopack-integration, "Manifest disk artifact" /
-	*  "Webpack mode skips the hydration corpus"). */
+	/** Whether the analysis-inputs hydration corpus is written to disk. Only
+	*  isolated loader workers replay it; an in-process loader reads memory. */
 	persistAnalysisInputs = false;
-	/** Absolute directory prefixes for external DS packages (loader allowlisting). */
+	/** Absolute directory prefixes for external packages (loader allowlist). */
 	externalPackageDirs = [];
 	/** Absolute package dir → owning specifier (cross-source correlation). */
 	externalDirOwners = {};
@@ -562,14 +578,11 @@ var ExtractionSession = class {
 	externalFileOwners = {};
 	/** External package specifier → absolute source entry path. */
 	externalSourceEntries = /* @__PURE__ */ new Map();
-	/** SourceId derivation authority for the current generation (openspec:
-	*  external-source-watch-ingestion, design D2) — canonical roots
-	*  realpath'd once per full pipeline; alias→SourceId associations
-	*  recorded while files exist so deletion resolves through the cache. */
+	/** SourceId authority for this generation — roots realpath'd once per
+	*  pipeline; aliases recorded while files exist so deletions resolve. */
 	sourceIdentity = null;
-	/** Canonical admitted external root → declared specifiers (set-valued
-	*  ownership, design D2; duplicate specifiers resolving to one canonical
-	*  root share it). Engine watch wiring and tests read this. */
+	/** Canonical admitted external root → declared specifiers; duplicate
+	*  specifiers resolving to one canonical root share an entry. */
 	externalRootOwners = /* @__PURE__ */ new Map();
 	/** Canonical external root → the extension set its collection walk used
 	*  (widened for dist-only roots); rewalks and classification share it. */
@@ -577,90 +590,81 @@ var ExtractionSession = class {
 	/** Canonical admitted external watch roots — the engine-side watch
 	*  surface (webpack contextDependencies / Turbopack watchers). */
 	externalWatchRoots = [];
-	/** Canonical external root → (raw sourceKey → {raw content hash, recorded
-	*  abs spelling}): the previous-generation inventory a dirty-root rewalk
-	*  diffs against (design D3). Raw hashes — MDX preprocessing never skews
-	*  the diff; the recorded abs path is a registered deletion alias, so a
-	*  reconstructed deletion always resolves through cached identity. */
+	/** Canonical external root → sourceKey → {raw content hash, recorded abs}:
+	*  the inventory a dirty-root rewalk diffs against, hashed before MDX. */
 	externalInventory = /* @__PURE__ */ new Map();
-	/** Sticky diagnostics (design D5/D7): stable key → message, re-surfaced
-	*  on every full pipeline until the underlying condition clears. */
+	/** Stable key → message, re-surfaced on every full pipeline until the
+	*  underlying condition clears. */
 	stickyDiagnostics = /* @__PURE__ */ new Map();
-	/** Volume-membership predicate for the cross-volume gate (design D5).
-	*  Injected seam: the shared predicate only discriminates on Windows
-	*  (win32 semantics are unit-tested via path.win32), so runtime tests
-	*  drive the gate through this. */
+	/** Volume-membership predicate for the cross-volume gate. Injected seam:
+	*  the real predicate only discriminates on Windows, so tests replace it. */
 	sharesProjectVolume = require_pipeline.sharesVolumeRoot;
-	/** Orchestrator seams (openspec: external-source-watch-ingestion, design
-	*  D4). `onExternalRootResolved` fires per volume-admitted external root
-	*  DURING collection — after resolution, BEFORE that root's sources are
-	*  walked — so a watching host can open its handle with no blind gap
-	*  between scan and watch. `onExternalRootsCommitted` fires once after a
-	*  successful full-pipeline publication with the complete admitted
-	*  canonical root set (the host's promote/replay/close-old phase; a
-	*  failed pipeline never fires it, so the host rolls back). */
+	/** `onExternalRootResolved` fires per admitted root DURING collection,
+	*  before its walk; `onExternalRootsCommitted` only after publication. */
 	onExternalRootResolved = null;
 	onExternalRootsCommitted = null;
+	/** Fires exactly once per settled `handleWatchUpdate` — the failure cause,
+	*  or null when clean. Observation never alters delivery. */
+	onCycleSettled = null;
 	options;
 	staticCssJson;
 	system = null;
-	/** Discovery-time keyframes diagnostics awaiting the shared surfacing pass. */
-	externalKeyframesDiagnostics = [];
+	/** Vocabulary witness diagnostics from the sealed system's registration
+	*  record, awaiting the shared surfacing pass. */
+	systemVocabularyDiagnostics = [];
+	/** Configured external files that could not be read. Incremental passes
+	*  re-collect nothing, so they replay these instead of passing strict. */
+	ingestionFailureDiagnostics = [];
 	/** Full package-resolution map from the last full pipeline — replayed by
 	*  incremental passes (sourceEntries alone omits dist-resolved packages). */
 	lastPackageMap = {};
 	fileCache = /* @__PURE__ */ new Map();
-	analysisEntryCache = /* @__PURE__ */ new Map();
-	sourceOwnership = {};
+	corpus = require_pipeline.createSourceCorpus({
+		engineApi: () => engineApi(),
+		prefix: "[animus-next]",
+		strict: () => !!this.options.strict,
+		warn: (message) => this.warn(message)
+	});
 	systemDependencyKeys = /* @__PURE__ */ new Set();
 	/** Loader-reported dependency paths for bundler watch registration. */
 	systemDependencyPaths = [];
 	systemDependencyHashes = /* @__PURE__ */ new Map();
 	lastSystemPropsHash = null;
-	/** Per-payload write guards: payloadHash gates rewrites (byte-identical
-	*  payloads leave disk untouched); diskHash is the hash of the CURRENT
-	*  disk bytes (envelope included) recorded in the analysis-commit. null =
-	*  not yet seeded (first publication reads the artifact's envelope so a
-	*  same-session restart never rewrites byte-identical artifacts). */
 	artifactRecords = {
 		manifest: null,
 		inputs: null,
 		styles: null
 	};
-	/** Last written analysis-commit; null = seeded from disk on first use. */
+	/** Last written analysis-commit; null seeds from disk on first use. Its
+	*  generation counter is correct only because one session owns the dir. */
 	lastCommit = null;
-	/** Session identity — claimed once per PROCESS (one Next invocation),
-	*  adopted by every subsequent session instance so all compilers share
-	*  one artifact tree (design D2: `next dev`/`next build` co-writing are
-	*  separate processes and therefore separate sessions). */
+	/** Release handle for the in-process owner slot AND the directory's
+	*  on-disk owner record, taken and released as one; null when unheld. */
+	releasePublicationClaim = null;
+	/** Session identity, claimed once per PROCESS and adopted by every later
+	*  session instance so all compilers share one artifact tree. */
 	sessionId = claimProcessSessionId();
-	/** Epoch value of the last published analysis; null = not yet known
-	*  (seeded from the session dir's artifact on first publication so a
-	*  same-session restart with unchanged plans never rewrites bytes). */
+	/** Epoch of the last published analysis; null seeds from disk so a
+	*  same-session restart with unchanged plans rewrites no bytes. */
 	lastEpochValue = null;
-	/** Watcher debounce ceiling feeding status deadlines (design D3). */
+	/** Watcher debounce ceiling feeding status deadlines. */
 	debounceCeilingMs = 75;
 	/** Test seam: observes every session-artifact write (name, content)
 	*  post-rename — write ORDER is part of the transaction contract. */
 	onArtifactWrite = null;
-	/** Status attempt bookkeeping (design D3). */
 	statusAttemptId = 0;
 	statusAttemptOpen = false;
-	/** Monotonic first-emission witness (openspec: standalone-extraction-cli,
-	*  watch readiness): flips true once the first complete publication
-	*  succeeds and never regresses — every later status write (idle AND
-	*  failed) carries it, so readiness stays observable across attempts. */
+	/** Monotonic readiness witness: flips true on the first complete
+	*  publication and never regresses; every later status write carries it. */
 	firstEmissionComplete = false;
 	/** Debounce-window observations pending analysis (sourceKey → hash). */
 	debouncePending = /* @__PURE__ */ new Map();
-	/** Session-start hygiene (pruning + legacy cleanup) runs once. */
 	sessionStartHygieneDone = false;
 	lcssTargets = null;
 	constructor(options) {
 		this.options = options;
 		this.staticCssJson = require_pipeline.serializeStaticCss(options.staticCss);
 	}
-	/** This session's artifact directory. Requires `rootDir` to be set. */
 	get sessionDir() {
 		return sessionArtifactDir(this.rootDir, this.sessionId);
 	}
@@ -679,24 +683,20 @@ var ExtractionSession = class {
 	elapsed(t) {
 		return this.verbose ? Math.round(performance.now() - t) : 0;
 	}
-	/** Lazily-computed scan config (options are constructor-fixed, so the
-	*  derivation is stable for the session's lifetime). */
-	/** Diagnostic prefix label — drivers set their own so a host's errors
-	*  never masquerade as another driver's (inc 05 review S1). The default
-	*  keeps the Next plugin's historical prefix. */
+	/** Diagnostic prefix label — drivers set their own so one host's errors
+	*  never masquerade as another driver's. */
 	driverLabel = "animus-next";
 	/** Per-specifier discovery outcomes from the last full collection —
 	*  driver-consumed reporting surface (the CLI's summary). */
 	lastExternalOutcomes = [];
-	/** Component count of the last published analysis, or null before the
-	*  first — the CLI's publish path reads this instead of re-parsing the
-	*  manifest JSON every cycle. */
+	/** Component count of the last published analysis, null before the first —
+	*  read by drivers instead of re-parsing the manifest JSON every cycle. */
 	lastComponentCount = null;
-	/** Driver-owned STRUCTURAL exclusions (a CLI outDir inside the root),
-	*  joined to the never-replaceable set — never the user `exclude` list,
-	*  whose presence would flip the replace semantics and silently drop the
-	*  replaceable defaults. Set before the first pipeline run (the scan
-	*  config is memoized). */
+	/** When superseded asset copies leave `assets/`: `'full-pipeline'` suits a
+	*  driver serving the dir in place, `'every-cycle'` one republishing it. */
+	staleAssetPruning = "full-pipeline";
+	/** Driver-owned STRUCTURAL exclusions, joined to the never-replaceable set
+	*  — never the user list, whose presence flips the replace semantics. */
 	structuralExclude = [];
 	scanConfigMemo = null;
 	/** Per-pattern exclusion hit counts from this session's matcher —
@@ -716,17 +716,18 @@ var ExtractionSession = class {
 		}
 		return this.scanConfigMemo;
 	}
-	/**
-	* Watch entry point: one single-flight analysis transaction per event
-	* batch (openspec: next-webpack-served-transform-coherence, design D3).
-	* The first entering session runs the transaction; every concurrent
-	* entry — same session re-entered, or another compiler's session
-	* (client/server/RSC each hold their own instance) — joins the in-flight
-	* promise, so no compiler proceeds against a generation older than the
-	* one the transaction publishes. A rejected transaction rejects every
-	* joiner; the gate always clears.
-	*/
+	/** One single-flight analysis transaction per event batch: concurrent
+	*  entries join the in-flight promise; each settled entry reports outcome. */
 	async handleWatchUpdate(changes) {
+		try {
+			await this.routeWatchUpdate(changes);
+		} catch (error) {
+			this.onCycleSettled?.(error);
+			throw error;
+		}
+		this.onCycleSettled?.(null);
+	}
+	async routeWatchUpdate(changes) {
 		const inflight = getWatchTransaction();
 		if (inflight) {
 			await inflight;
@@ -746,13 +747,8 @@ var ExtractionSession = class {
 			setWatchTransaction(null);
 		}
 	}
-	/**
-	* Owner-side entry for a batch observed by a NON-OWNING compiler's
-	* watcher. Serializes behind any in-flight transaction, then runs the
-	* forwarded batch as its own transaction — never drops it (a forwarded
-	* batch has no other delivery; content-hash diffing makes an
-	* already-covered batch a cheap no-op).
-	*/
+	/** Owner-side entry for a batch a non-owning compiler observed. Serializes
+	*  behind any in-flight transaction — it has no other delivery. */
 	async ingestForwardedBatch(changes) {
 		if (!this.system) return;
 		for (;;) {
@@ -768,11 +764,6 @@ var ExtractionSession = class {
 			setWatchTransaction(null);
 		}
 	}
-	/**
-	* Incremental watch pass: geological reset when the system file changed,
-	* otherwise content-hash diffing restricted to the watcher's change sets
-	* (falling back to a full discovery walk when no sets are provided).
-	*/
 	async processWatchUpdate(changes) {
 		const rootDir = this.rootDir;
 		try {
@@ -796,14 +787,14 @@ var ExtractionSession = class {
 			}
 			else systemHit = changed.find((path$2) => require_pipeline.toWatchKeys(path$2).some((key) => this.systemDependencyKeys.has(key)));
 		} catch (err) {
-			this.warn(`HMR geological-reset check failed: ${String(err)}`);
+			this.warn(`HMR system-reload check failed: ${String(err)}`);
 		}
 		if (systemHit) {
-			this.log(`geological reset: system dependency changed (${(0, path.relative)(rootDir, systemHit)})`);
+			this.log(`system reload: system dependency changed (${(0, path.relative)(rootDir, systemHit)})`);
 			this.resetForHmr();
 			try {
 				const promise = this.runFullPipeline(this.pendingFromBatch(changes));
-				setAnalysisPromise(promise);
+				setAnalysisStartedPromise(promise);
 				await promise;
 			} catch (err) {
 				try {
@@ -907,11 +898,14 @@ var ExtractionSession = class {
 			let ingested;
 			try {
 				this.beginStatusAttempt();
-				ingested = await this.ingestAccepted();
-				this.externalFileOwners = this.projectExternalFileOwners(ingested, this.externalFileOwners);
-				resetAnalysisPromise();
+				ingested = await this.corpus.prepare({
+					fileCache: this.fileCache,
+					externalFileOwners: this.externalFileOwners
+				});
+				this.externalFileOwners = require_pipeline.projectExternalFileOwners(ingested, this.externalFileOwners);
+				resetAnalysisStartedPromise();
 				const promise = this.runIncrementalPipeline(ingested.analysisEntries, pending);
-				setAnalysisPromise(promise);
+				setAnalysisStartedPromise(promise);
 				await promise;
 			} catch (err) {
 				for (const [key, prior] of priorCacheEntries) if (prior === null) this.fileCache.delete(key);
@@ -942,60 +936,39 @@ var ExtractionSession = class {
 			this.writeAnalysisStatus("idle", []);
 		}
 	}
-	/** The shared ingestion policy point (vite-plugin parity BY CODE): the
-	*  capability guard, facts memo, and warn-dedupe lifecycle live in the
-	*  pipeline; this host holds only its prefix, strict flag, and warn sink. */
-	sourceIngestor = require_pipeline.createSourceIngestor({
-		engineApi: () => engineApi(),
-		prefix: "[animus-next]",
-		strict: () => !!this.options.strict,
-		warn: (message) => this.warn(message)
-	});
-	/** Prepare one raw-source corpus through the shared adaptation boundary. */
-	async ingestRawSources(entries) {
-		return this.sourceIngestor.ingest(entries);
-	}
-	/** Ingest and apply the shared per-file quarantine: one invalid original
-	*  (an `.mdx` with the optional peer absent, an unsupported `.svelte`
-	*  shape) warns and drops; the rest of the corpus still analyzes. Strict
-	*  mode throws from the shared policy — callers route that into their own
-	*  status/rollback handling. */
-	async ingestAccepted(entries) {
-		const ingested = await this.ingestRawSources(entries ?? this.buildRawEntriesFromCache());
-		return require_pipeline.withoutInvalidOriginals(ingested, this.surfaceSourceDiagnostics(ingested.diagnostics));
-	}
-	/** Surface parser diagnostics under the shared strict/warn policy. */
-	surfaceSourceDiagnostics(diagnostics) {
-		return this.sourceIngestor.surfaceDiagnostics(diagnostics);
-	}
-	/**
-	* Correlate diagnostics emitted against generated children back to the
-	* external package owning their raw original.
-	*/
-	projectExternalFileOwners(result, rawOwners) {
-		const projected = {};
-		for (const owner of Object.values(result.ownership)) {
-			const packageOwner = rawOwners[owner.originalPath];
-			if (!packageOwner) continue;
-			projected[owner.originalPath] = packageOwner;
-			for (const analysisPath of owner.analysisPaths) projected[analysisPath] = packageOwner;
-		}
-		return projected;
-	}
-	/** Publish the raw cache and complete parser projection atomically. */
 	publishSourceIngestion(result) {
-		this.sourceIngestor.markPublished(result);
 		this.fileCache = new Map(result.originalEntries.map((entry) => [entry.path, {
 			hash: entry.hash,
 			source: entry.source
 		}]));
-		this.analysisEntryCache = new Map(result.analysisEntries.map((entry) => [entry.path, {
-			hash: entry.hash,
-			source: entry.source
-		}]));
-		this.sourceOwnership = result.ownership;
+		this.corpus.publish(result);
 	}
+	/** Full analysis + publication, registered in the one in-flight
+	*  transaction slot; a nested reload leaves the enclosing registration. */
 	async runFullPipeline(pending = []) {
+		if (this.releasePublicationClaim === null) {
+			const releaseOwner = claimExclusiveSessionOwner(`${this.driverLabel}:${this.sessionDir}`);
+			(0, fs.mkdirSync)(this.sessionDir, { recursive: true });
+			const releaseClaimRecord = holdDirectoryClaim(this.sessionDir);
+			this.releasePublicationClaim = () => {
+				releaseOwner();
+				releaseClaimRecord();
+			};
+		}
+		const priorSystem = this.system;
+		const nested = getWatchTransaction() !== null;
+		const transaction = this.runPipelineTransaction(pending);
+		if (!nested) setWatchTransaction(transaction);
+		try {
+			await transaction;
+		} catch (error) {
+			this.system = priorSystem;
+			throw error;
+		} finally {
+			if (!nested) setWatchTransaction(null);
+		}
+	}
+	async runPipelineTransaction(pending) {
 		const pipelineStart = this.now();
 		const bt = {};
 		this.runSessionStartHygiene();
@@ -1009,6 +982,7 @@ var ExtractionSession = class {
 			rootDir,
 			prefix: this.options.prefix
 		});
+		this.systemVocabularyDiagnostics = require_pipeline.vocabularyWitnessDiagnostics(this.system.vocabularyWitnessesJson);
 		this.assetCopyCache.clear();
 		this.assetDependencyPaths.clear();
 		this.assetDependencyKeys.clear();
@@ -1049,6 +1023,7 @@ var ExtractionSession = class {
 		const packageNames = require_pipeline.extractSystemFilePackages(resolvedSystemPath);
 		const preResolved = resolvePackagesByName(rootDir, packageNames);
 		const rawExternalFiles = /* @__PURE__ */ new Map();
+		const ingestionFailures = [];
 		const collected = await require_pipeline.collectExternalPackageSources({
 			specifiers: packageNames,
 			resolveSpecifier: (name) => preResolved[name] ? (0, path.resolve)(rootDir, preResolved[name]) : null,
@@ -1058,7 +1033,7 @@ var ExtractionSession = class {
 			onSourceRead: (source, _relPath, absPath) => {
 				rawExternalFiles.set(absPath, require_pipeline.contentHash(source));
 			},
-			onUnreadable: (relPath, err) => this.warn(`skipped unreadable package file ${relPath}: ${String(err)}`),
+			onUnreadable: (relPath, err) => ingestionFailures.push(require_pipeline.unreadableSourceDiagnostic(relPath, err)),
 			onPackageResolved: (_specifier, packageDir) => {
 				if (!this.onExternalRootResolved) return;
 				if (!this.sharesProjectVolume(rootDir, packageDir)) return;
@@ -1070,6 +1045,7 @@ var ExtractionSession = class {
 			}
 		});
 		this.lastExternalOutcomes = collected.outcomes;
+		this.ingestionFailureDiagnostics = ingestionFailures;
 		for (const record of collected.outcomes) if (record.outcome === "empty") this.warn(`include '${record.specifier}' resolved but discovered no component sources`);
 		const unresolvableMessage = require_pipeline.unresolvableIncludesMessage(collected.outcomes);
 		if (unresolvableMessage !== null) {
@@ -1138,23 +1114,17 @@ var ExtractionSession = class {
 				});
 			}
 			this.externalPackageDirs = admitted.packageDirs;
-			if (this.system && admitted.keyframesScanEntries.size > 0) {
-				const api = engineApi();
-				const merge = require_pipeline.mergeExternalKeyframes((entry, root) => api.scanKeyframesExports(entry, root), this.system.keyframesJson, admitted.keyframesScanEntries.values(), this.rootDir);
-				this.system.keyframesJson = merge.keyframesJson;
-				this.externalKeyframesDiagnostics = merge.diagnostics;
-			} else this.externalKeyframesDiagnostics = [];
 			bt.packageResolve = this.elapsed(t);
 			this.beginStatusAttempt();
 			let accepted;
 			try {
-				accepted = await this.ingestAccepted(rawEntries);
+				accepted = await this.corpus.prepare(rawEntries);
 			} catch (err) {
 				this.debouncePending.clear();
 				this.writeAnalysisStatus("failed", pending, String(err));
 				throw err;
 			}
-			this.externalFileOwners = this.projectExternalFileOwners(accepted, this.externalFileOwners);
+			this.externalFileOwners = require_pipeline.projectExternalFileOwners(accepted, this.externalFileOwners);
 			bt.fileCount = accepted.analysisEntries.length;
 			require_pipeline.clearEngineCache(engineApi);
 			await this.analyzeAndEmit(accepted.analysisEntries, packageMap, false, bt, pipelineStart, pending);
@@ -1168,10 +1138,8 @@ var ExtractionSession = class {
 			throw err;
 		}
 	}
-	/** The per-generation source state runFullPipeline mutates, captured as
-	*  ONE object so the restore below cannot omit a member. The three
-	*  deep-copied fields are the ones later steps mutate in place rather
-	*  than reassign; everything else is rebound wholesale on success. */
+	/** Per-generation source state captured as ONE object so the restore
+	*  cannot omit a member; deep-copied fields are mutated in place. */
 	snapshotSourceState() {
 		return {
 			sourceIdentity: this.sourceIdentity,
@@ -1184,20 +1152,23 @@ var ExtractionSession = class {
 			externalFileOwners: this.externalFileOwners,
 			externalSourceEntries: this.externalSourceEntries,
 			externalPackageDirs: this.externalPackageDirs,
-			externalKeyframesDiagnostics: this.externalKeyframesDiagnostics
+			systemVocabularyDiagnostics: this.systemVocabularyDiagnostics,
+			ingestionFailureDiagnostics: this.ingestionFailureDiagnostics
 		};
 	}
 	restoreSourceState(snapshot) {
 		Object.assign(this, snapshot);
 	}
-	/**
-	* Reset analysis state for HMR geological reset. Payload write guards go
-	* back to null so the next publication reseeds them from the disk
-	* envelopes — a byte-identical post-reset artifact is still not
-	* rewritten.
-	*/
+	/** Release this session's publication claim so a successor may publish.
+	*  Idempotent, and scoped to this session's own claim. */
+	close() {
+		this.releasePublicationClaim?.();
+		this.releasePublicationClaim = null;
+	}
+	/** Reset analysis state for a system reload: write guards go back to null
+	*  and reseed from the disk envelopes on the next publication. */
 	resetForHmr() {
-		resetAnalysisPromise();
+		resetAnalysisStartedPromise();
 		this.artifactRecords = {
 			manifest: null,
 			inputs: null,
@@ -1205,12 +1176,8 @@ var ExtractionSession = class {
 		};
 		this.lastSystemPropsHash = null;
 	}
-	/**
-	* The (sourceKey, observedSourceHash) pairs of a watch batch — cheap
-	* evidence for the status file's pending set on the geological-reset
-	* path, where the batch's component edits ride along with the system
-	* edit (design D3: loaders wait only on observed inputs).
-	*/
+	/** The (sourceKey, observed hash) pairs of a watch batch — the status
+	*  file's pending set; loaders wait only on observed inputs. */
 	pendingFromBatch(changes) {
 		const { excludeMatcher, extensionsSet } = this.resolveScanConfig();
 		const pending = [];
@@ -1226,17 +1193,8 @@ var ExtractionSession = class {
 		}
 		return pending;
 	}
-	/**
-	* Root-dirty inventory reconciliation (design D3): partition the
-	* watcher's change sets into explicit FILE events and external ROOT hits
-	* (a reported path that IS an admitted root, or a directory inside one),
-	* rewalk each dirty root through the shared discovery policy, diff the
-	* SourceId+raw-hash inventory against the previous generation, and merge
-	* the reconstructed created/edited/deleted deltas with the explicit
-	* events (identity-level dedup happens downstream at the cache gate).
-	* Deletion falls out of the inventory diff — webpack may report only the
-	* directory (probe-proven).
-	*/
+	/** Rewalk dirty external roots and diff the inventory into created,
+	*  edited and deleted deltas: a watcher may report only the directory. */
 	reconcileExternalRoots(changes) {
 		const identity = this.sourceIdentity;
 		if (!identity) return changes;
@@ -1289,14 +1247,8 @@ var ExtractionSession = class {
 			removedFiles: removed
 		};
 	}
-	/**
-	* Route one watcher-reported path (design D1/D2): a project-root member
-	* (lexical containment — existing local semantics preserved; consumer
-	* exclude patterns apply) or an admitted external member (identity
-	* resolution with symlink-escape rejection; package-relative excludes
-	* mirror the collection walk's filters — guardrail G1, one policy).
-	* Returns null for dropped paths.
-	*/
+	/** Route one watcher path: a project-root member (consumer excludes apply)
+	*  or an admitted external member (symlink escapes rejected). */
 	classifyWatchPath(absPath, scan) {
 		const ext = (0, path.extname)(absPath);
 		const rootDir = this.rootDir;
@@ -1326,51 +1278,13 @@ var ExtractionSession = class {
 			owningRoot: resolved.owningRoot
 		};
 	}
-	/** Build full raw originals for one shared adaptation attempt. */
-	buildRawEntriesFromCache() {
-		const entries = [];
-		for (const [path$8, { hash, source }] of this.fileCache) entries.push({
-			path: path$8,
-			source,
-			hash
-		});
-		return entries;
-	}
-	/**
-	* Run incremental pipeline with cache-aware file entries.
-	* Reuses system config from the last full pipeline run.
-	*/
 	async runIncrementalPipeline(fileEntries, pending = []) {
 		const bt = {};
 		const pipelineStart = this.now();
 		await this.analyzeAndEmit(fileEntries, this.lastPackageMap, true, bt, pipelineStart, pending);
 	}
-	/**
-	* Shared analysis + emit core for both pipelines — the single call site
-	* that routes every manifest through the shared `runProjectAnalysis`,
-	* reachable from both runFullPipeline (production) and
-	* runIncrementalPipeline (HMR).
-	*
-	* Owns diagnostic surfacing, CSS assembly + styles.css write guard,
-	* system-props module emit, and the timing log. The engine's own
-	* `dev_mode` (reconciliation pruning) is derived separately via
-	* `engineDevMode` — an explicit `mode` option overrides the pipeline
-	* path there. For everything else the `devMode` flag is the ONLY
-	* behavioral fork:
-	*
-	* - `false` (production): computes bt.analysis + logs the extraction
-	*   report, and writes system-props.js UNCONDITIONALLY (no
-	*   lastSystemPropsHash guard).
-	* - `true` (HMR): skips the report log, and guards the system-props.js
-	*   write by lastSystemPropsHash.
-	*
-	* The disk artifacts land under the session directory in transaction
-	* order (design D1): manifest → analysis-inputs (Turbopack orchestration
-	* only) → styles.css → system-props → analysis-commit →
-	* replacements-epoch (last, only when moved). The analysis-status file walks starting → analyzing →
-	* committing → idle around the attempt, landing in `failed` (with the
-	* diagnostic) on any throw (design D3).
-	*/
+	/** Shared analysis + emit core for both pipelines. `devMode` forks only
+	*  the report log and the system-props write guard. */
 	async analyzeAndEmit(fileEntries, packageMap, devMode, bt, pipelineStart, pending = []) {
 		this.beginStatusAttempt();
 		this.debouncePending.clear();
@@ -1384,16 +1298,8 @@ var ExtractionSession = class {
 			throw err;
 		}
 	}
-	/**
-	* The engine's `dev_mode` flag (retain all components vs reconciliation
-	* pruning) is an EMISSION decision, so an explicit `mode` option wins over
-	* the pipeline path (core-options: `mode` "decides emitted bytes …
-	* engine devMode"). Without an explicit mode the historical per-pipeline
-	* default applies: full = production pruning, incremental = dev retention.
-	* A pinned-production watch must not flip to unpruned CSS on its first
-	* incremental republication, and a pinned-development full build must
-	* retain all components.
-	*/
+	/** An explicit `mode` wins over the pipeline path: a pinned-production
+	*  watch must not emit unpruned CSS on its first incremental republish. */
 	engineDevMode(pipelineDefault) {
 		if (this.options.mode !== void 0) return this.options.mode === "development";
 		return pipelineDefault;
@@ -1419,7 +1325,7 @@ var ExtractionSession = class {
 			...analysisOptions,
 			warn: (message) => this.warn(message),
 			strict: this.options.strict,
-			extraDiagnostics: this.externalKeyframesDiagnostics
+			extraDiagnostics: [...this.systemVocabularyDiagnostics, ...this.ingestionFailureDiagnostics]
 		});
 		require_pipeline.assertNoErrorDiagnostics(result.manifest?.diagnostics);
 		require_pipeline.enforceExternalTokenContracts({
@@ -1440,7 +1346,7 @@ var ExtractionSession = class {
 			bt.analysis = (bt.jsonSerialize ?? 0) + (bt.rustExtract ?? 0) + (bt.jsonParse ?? 0);
 			if (manifest?.report) this.log(`Extracted ${manifest.report.components_extracted ?? "?"}/${manifest.report.components_total ?? "?"} components (${bt.analysis}ms)`);
 		}
-		const globalCss = this.substituteAssetReferences(result.globalCss, devMode);
+		const globalCss = this.substituteAssetReferences(result.globalCss, !devMode || this.staleAssetPruning === "every-cycle");
 		const { declaration, variables, body } = require_pipeline.assembleStylesheet({
 			layers: this.options.layers,
 			variableCss: system.variableCss,
@@ -1497,8 +1403,8 @@ var ExtractionSession = class {
 			this.statusAttemptOpen = true;
 		}
 	}
-	/** Write the session's analysis-status artifact (design D3). Terminal
-	*  states (idle/failed) close the attempt. */
+	/** Write the session's analysis-status artifact. Terminal states
+	*  (idle/failed) close the attempt. */
 	writeAnalysisStatus(state, pending, diagnostic) {
 		const status = {
 			schema: 2,
@@ -1506,19 +1412,15 @@ var ExtractionSession = class {
 			attemptId: this.statusAttemptId,
 			state,
 			pending,
-			deadlineAt: Date.now() + this.debounceCeilingMs + STATUS_WATCHDOG_MS,
-			...diagnostic !== void 0 ? { diagnostic } : {},
-			ready: this.firstEmissionComplete
+			deadlineAt: Date.now() + this.debounceCeilingMs + STATUS_WATCHDOG_MS
 		};
+		if (diagnostic !== void 0) status.diagnostic = diagnostic;
+		status.ready = this.firstEmissionComplete;
 		this.writeSessionArtifact(ANALYSIS_STATUS_ARTIFACT, JSON.stringify(status));
 		if (state === "idle" || state === "failed") this.statusAttemptOpen = false;
 	}
-	/**
-	* Orchestrator seam (Turbopack watcher): record watch events observed
-	* during the debounce window so a loader running ahead of the analysis
-	* has positive evidence to wait on (design D3 'debouncing'). Paths are
-	* filtered by the scan config and hashed at observation time.
-	*/
+	/** Record watch events observed during the debounce window so a loader
+	*  running ahead of the analysis has evidence to wait on. */
 	noteDebouncedWatchEvents(absPaths) {
 		if (!this.rootDir) return;
 		const additions = this.pendingFromBatch({ modifiedFiles: new Set(absPaths) });
@@ -1539,14 +1441,8 @@ var ExtractionSession = class {
 	}
 	/** One pending microtask flushes a burst of debounce observations. */
 	debounceStatusWriteScheduled = false;
-	/**
-	* Write one payload artifact into the session directory, enveloped with
-	* `{sessionId, generation, replacementEpoch, payloadHash}` and rewritten
-	* only when the PAYLOAD bytes changed (byte-identical re-analyses leave
-	* disk untouched — spec: "Unchanged manifest is not rewritten"). The
-	* recorded diskHash (hash of the enveloped bytes) feeds the
-	* analysis-commit.
-	*/
+	/** Write one enveloped payload artifact, rewritten only when the PAYLOAD
+	*  bytes changed; the recorded diskHash feeds the analysis-commit. */
 	publishPayloadArtifact(key, name, payload, epoch, generation, wrap) {
 		const payloadHash = require_pipeline.contentHash(payload);
 		if (this.artifactRecords[key] === null) this.artifactRecords[key] = this.seedPayloadRecord(key, name);
@@ -1580,7 +1476,7 @@ var ExtractionSession = class {
 		} catch {
 			return null;
 		}
-		if (!envelope || typeof envelope.payloadHash !== "string") return null;
+		if (!envelope || !isDiskString(envelope.payloadHash)) return null;
 		return {
 			payloadHash: envelope.payloadHash,
 			diskHash: require_pipeline.contentHash(bytes)
@@ -1590,18 +1486,13 @@ var ExtractionSession = class {
 	seedCommitFromDisk() {
 		try {
 			const parsed = JSON.parse((0, fs.readFileSync)(analysisCommitPath(this.sessionDir), "utf-8"));
-			return parsed.schema === 1 && parsed.sessionId === this.sessionId && typeof parsed.generation === "number" ? parsed : null;
+			return parsed.schema === 1 && parsed.sessionId === this.sessionId && isDiskNumber(parsed.generation) ? parsed : null;
 		} catch {
 			return null;
 		}
 	}
-	/**
-	* Publish the analysis-commit — the transaction identity (design D1).
-	* Written AFTER every payload and BEFORE the epoch; skipped entirely when
-	* the payload set (disk hashes) and epoch are unchanged, so a no-op
-	* re-analysis neither re-keys loader-worker hydration nor burns a
-	* generation.
-	*/
+	/** Publish the analysis-commit: written after every payload and before the
+	*  epoch, skipped when the payload hashes and epoch are unchanged. */
 	publishAnalysisCommit(epoch, generation) {
 		const manifestHash = this.artifactRecords.manifest?.diskHash ?? "";
 		const inputsHash = this.persistAnalysisInputs ? this.artifactRecords.inputs?.diskHash ?? "" : void 0;
@@ -1614,21 +1505,14 @@ var ExtractionSession = class {
 			generation,
 			replacementEpoch: epoch,
 			manifestHash,
-			...inputsHash !== void 0 ? { inputsHash } : {},
 			stylesHash
 		};
+		if (inputsHash !== void 0) commit.inputsHash = inputsHash;
 		this.writeSessionArtifact(ANALYSIS_COMMIT_ARTIFACT, JSON.stringify(commit));
 		this.lastCommit = commit;
 	}
-	/**
-	* Publish the canonical replacement epoch: maintain the session-scoped
-	* disk witness `{schema, sessionId, epoch}`, rewritten ONLY when the
-	* epoch VALUE changes so style-only analyses and same-session restarts
-	* leave bytes and mtime untouched, then expose the value through the
-	* singleton for the plugin's needBuild fan-out and the loader's catch-up
-	* re-check. Every VALUE move also reconciles sibling sessions' epoch
-	* artifacts (below) — the webpack cold-cache validity witness.
-	*/
+	/** Maintain the session's epoch witness, rewritten ONLY when the value
+	*  changes, then expose it through the singleton. */
 	publishReplacementEpoch(epoch) {
 		const onDisk = this.diskEpochValue();
 		if (this.lastEpochValue === null) this.lastEpochValue = onDisk;
@@ -1643,26 +1527,13 @@ var ExtractionSession = class {
 		}
 		setReplacementEpoch(epoch);
 	}
-	/**
-	* Sibling epoch reconciliation — the cross-session half of the webpack
-	* persistent-cache witness (spec: dev-served-transform-coherence,
-	* "Offline change invalidates restored modules"). Restored-module
-	* snapshots reference the epoch artifact of the session that BUILT them;
-	* with session-scoped trees that file would otherwise sit untouched
-	* forever, keeping stale snapshots valid. Whenever this session's epoch
-	* value moves, delete every sibling epoch artifact that disagrees (their
-	* snapshots must invalidate — restore-on-demand then rebuilds from the
-	* current generation) and leave agreeing siblings byte-untouched (warm
-	* restores stay valid). Deleting a stale artifact is pruning, not a
-	* foreign-session write; races with concurrent sessions are tolerated
-	* (S14).
-	*/
-	/** Sibling ids already reconciled away (artifact deleted or absent) —
-	*  nothing left to invalidate for them on later moves. */
-	reconciledSiblingIds = /* @__PURE__ */ new Set();
 	/** sessions-root listing memo, keyed by the root dir's mtime — a new or
 	*  pruned sibling DIRECTORY moves it; agreeing siblings stay listed. */
 	siblingListing = null;
+	/** Restored-module snapshots point at the epoch artifact of the session
+	*  that built them, so a moved epoch deletes every DISAGREEING sibling
+	*  artifact to invalidate them. Agreeing siblings stay byte-untouched so
+	*  warm restores keep working; a sibling with a live owner is exempt. */
 	reconcileSiblingEpochs(epoch) {
 		const rootPath = sessionsRootDir(this.rootDir);
 		let entries;
@@ -1681,61 +1552,61 @@ var ExtractionSession = class {
 		}
 		for (const entry of entries) {
 			if (entry === this.sessionId) continue;
-			if (this.reconciledSiblingIds.has(entry)) continue;
-			const siblingEpochPath = (0, path.join)(rootPath, entry, REPLACEMENT_EPOCH_ARTIFACT);
+			const siblingDir = (0, path.join)(rootPath, entry);
+			const siblingEpochPath = (0, path.join)(siblingDir, REPLACEMENT_EPOCH_ARTIFACT);
 			try {
 				if (JSON.parse((0, fs.readFileSync)(siblingEpochPath, "utf-8")).epoch === epoch) continue;
 			} catch (err) {
-				if (err?.code === "ENOENT") {
-					this.reconciledSiblingIds.add(entry);
-					continue;
-				}
+				if (err?.code === "ENOENT") continue;
+			}
+			const ownerPid = this.liveSiblingOwnerPid(siblingDir);
+			if (ownerPid !== null) {
+				this.warn(`sibling session ${entry} still has a live owner (pid ${ownerPid}) and its replacement epoch disagrees with this session's (${epoch}) — leaving its epoch artifact in place`);
+				continue;
 			}
 			try {
 				(0, fs.unlinkSync)(siblingEpochPath);
 			} catch {}
-			this.reconciledSiblingIds.add(entry);
 		}
 	}
+	/** The pid of `siblingDir`'s live owner, or null when nothing proves one.
+	*  Our own pid is never one — publication is process-exclusive. A missing,
+	*  undecodable or unreadable claim all mean no owner: the opposite default
+	*  from the CLI lock check on purpose, so do not unify the two. */
+	liveSiblingOwnerPid(siblingDir) {
+		let claim;
+		try {
+			claim = readCliLockRecord(siblingDir);
+		} catch {
+			return null;
+		}
+		if (claim.kind !== "held") return null;
+		if (claim.record.pid === process.pid) return null;
+		return checkLockLiveness(claim.record).live ? claim.record.pid : null;
+	}
 	/** Epoch value held by this session's on-disk artifact, or null when
 	*  absent, unreadable, or not the expected schema. */
 	diskEpochValue() {
 		try {
 			const parsed = JSON.parse((0, fs.readFileSync)(replacementEpochPath(this.sessionDir), "utf-8"));
-			return parsed.schema === 1 && typeof parsed.epoch === "string" ? parsed.epoch : null;
+			return parsed.schema === 1 && isDiskString(parsed.epoch) ? parsed.epoch : null;
 		} catch {
 			return null;
 		}
 	}
-	/** True when the flat `.animus/` advisory lock names a live pid — a CLI
-	*  invocation (build mid-publish, or a whole watch run) owns the flat
-	*  tree right now, and any instantaneous inconsistency is its in-flight
-	*  write, not debris. */
+	/** True when the flat `.animus/` advisory lock claims the tree. A lock that
+	*  exists but cannot be decoded claims it too — unknown is never absent. */
 	cliWriterHoldsLock(animusDir) {
-		let holder;
-		try {
-			holder = JSON.parse((0, fs.readFileSync)((0, path.join)(animusDir, CLI_LOCK_ARTIFACT), "utf-8"));
-		} catch {
-			return false;
-		}
-		if (typeof holder.pid !== "number") return false;
-		try {
-			process.kill(holder.pid, 0);
-			return true;
-		} catch {
-			return false;
-		}
+		const lock = readCliLockRecord(animusDir);
+		if (lock.kind === "none") return false;
+		return lock.kind === "indeterminate" || checkLockLiveness(lock.record).live;
 	}
-	/** Session-start hygiene (design D2): delete legacy flat artifacts
-	*  (unreachable by session-scoped loaders; the standalone CLI is the one
-	*  remaining writer of flat payload names, and its live output is
-	*  fenced off below) and prune sibling session directories older than
-	*  the retention window — never the own dir, tolerating races with
-	*  concurrently-pruning sessions (S14). */
+	/** Delete legacy flat artifacts and prune sibling session directories past
+	*  the retention window — never this session's own dir. */
 	runSessionStartHygiene() {
 		if (this.sessionStartHygieneDone) return;
 		this.sessionStartHygieneDone = true;
-		const animusDir = (0, path.join)(this.rootDir, ".animus");
+		const animusDir = (0, path.join)(this.rootDir, ANIMUS_ARTIFACT_DIR);
 		const isCliPublishedSet = this.cliWriterHoldsLock(animusDir) || verifyCommitRecord(animusDir).length === 0;
 		const cliPublishedNames = [
 			MANIFEST_ARTIFACT,
@@ -1762,18 +1633,17 @@ var ExtractionSession = class {
 			if (entry === this.sessionId) continue;
 			const dir = (0, path.join)(sessionsRootDir(this.rootDir), entry);
 			try {
-				if ((0, fs.statSync)(dir).mtimeMs < cutoff) (0, fs.rmSync)(dir, {
+				if ((0, fs.statSync)(dir).mtimeMs >= cutoff) continue;
+				if (this.liveSiblingOwnerPid(dir) !== null) continue;
+				(0, fs.rmSync)(dir, {
 					recursive: true,
 					force: true
 				});
 			} catch {}
 		}
 	}
-	/** Ensure the session directory exists and write one artifact into it.
-	*  Write-then-rename so cross-process readers (Turbopack loader workers)
-	*  can never observe a torn half-written file. The tmp name carries the
-	*  pid — Next dev evaluates the config in more than one process, and two
-	*  sessions writing the same artifact must not race on one tmp path. */
+	/** Write one artifact write-then-rename, so a cross-process reader never
+	*  sees a torn file; the tmp name carries the pid to keep writers apart. */
 	writeSessionArtifact(name, content) {
 		const dir = this.sessionDir;
 		(0, fs.mkdirSync)(dir, { recursive: true });
@@ -1782,19 +1652,9 @@ var ExtractionSession = class {
 		(0, fs.renameSync)(tmpPath, (0, path.join)(dir, name));
 		this.onArtifactWrite?.(name, content);
 	}
-	/**
-	* asset() placeholder substitution (global-styles-system): resolve each
-	* referenced specifier through Node resolution, copy the bytes into the
-	* session directory's `assets/` under a content-hashed name, and
-	* substitute a RELATIVE url — relative to the session-scoped styles.css,
-	* which sits beside `assets/`, so the emitted `./assets/<file>` form is
-	* unchanged. The stylesheet is processed by Next's own CSS pipeline
-	* (webpack and Turbopack alike), which applies its native asset handling
-	* — publicPath and output hashing — to relative url() references.
-	* Unsubstitutable specifiers warn and emit literally in non-strict mode,
-	* fail the build under `strict: true`.
-	*/
-	substituteAssetReferences(globalCss, devMode) {
+	/** Copy each asset() specifier's bytes into `assets/` under a
+	*  content-hashed name and substitute a url relative to styles.css. */
+	substituteAssetReferences(globalCss, pruneSuperseded) {
 		const specifiers = require_pipeline.findAssetSpecifiers(globalCss);
 		const assetsDir = (0, path.join)(this.sessionDir, SESSION_ASSETS_DIR);
 		const expected = /* @__PURE__ */ new Set();
@@ -1839,19 +1699,15 @@ var ExtractionSession = class {
 				url
 			});
 		}
-		if (!devMode) pruneStaleAssets(assetsDir, expected);
+		if (pruneSuperseded) pruneStaleAssets(assetsDir, expected);
 		return require_pipeline.substituteAssetPlaceholders(globalCss, urlBySpecifier);
 	}
-	trackAssetDependency(path$9) {
-		this.assetDependencyPaths.add(path$9);
-		for (const key of require_pipeline.toWatchKeys(path$9)) this.assetDependencyKeys.add(key);
+	trackAssetDependency(path$8) {
+		this.assetDependencyPaths.add(path$8);
+		for (const key of require_pipeline.toWatchKeys(path$8)) this.assetDependencyKeys.add(key);
 	}
-	/**
-	* Resolve an asset specifier to an absolute file via the shared pipeline
-	* resolver (host aliases → Node resolution → package root), with one
-	* session-local last resort: an already-discovered source entry's package
-	* root (dist-less workspace kits the shared resolver cannot see).
-	*/
+	/** Resolve an asset specifier through the shared resolver, with one
+	*  last resort: a discovered source entry's package root. */
 	resolveAssetSpecifier(specifier) {
 		const resolved = require_pipeline.resolveAssetFile(specifier, this.rootDir, this.pathAliasesJson);
 		if (resolved) return resolved;
@@ -1867,15 +1723,8 @@ var ExtractionSession = class {
 		return null;
 	}
 };
-/**
-* Sync `.animus/assets/` to the current build's content-hashed file set:
-* anything else in the directory is a superseded revision (the copies are
-* content-addressed and never overwritten) or the leftover of an asset()
-* reference that no longer exists. Failures are tolerated per entry — Next
-* dev evaluates the config in more than one process, and a concurrent
-* session may have removed (or be about to rewrite) the same file; every
-* pass rewrites whatever of its own set is missing, so races self-heal.
-*/
+/** Sync `assets/` to the current build's file set; per-entry failures are
+*  tolerated — a concurrent session may have removed the same file. */
 function pruneStaleAssets(assetsDir, expected) {
 	if (!(0, fs.existsSync)(assetsDir)) return;
 	let entries;
@@ -1893,61 +1742,54 @@ function pruneStaleAssets(assetsDir, expected) {
 }
 //#endregion
 //#region session/turbopack-orchestrator.ts
-/**
-* Out-of-band pipeline orchestration for Turbopack (spec:
-* next-turbopack-integration). Turbopack exposes no compiler hooks, so the
-* pipeline runs during next.config resolution and, in dev, from a
-* filesystem watcher — the bundler only ever sees the `.animus/` disk
-* artifacts.
-*/
-/** Run the full pipeline with the Turbopack emitter identity: the virtual
-*  system-props id (Turbopack rejects the webpack path's absolute-path
-*  imports). Turbopack orchestration persists the analysis-inputs
-*  hydration corpus — its isolated loader workers replay it (spec:
-*  next-turbopack-integration, "Manifest disk artifact"; webpack mode
-*  skips the corpus). */
 async function runSessionPipeline(session) {
 	session.systemPropsModuleId = TURBOPACK_SYSTEM_PROPS_ID;
 	session.persistAnalysisInputs = true;
 	await session.runFullPipeline();
 }
 const activeWatcherRoots = /* @__PURE__ */ new Set();
-const IGNORED_SEGMENTS = new Set([
-	".animus",
+const IGNORED_SEGMENTS = /* @__PURE__ */ new Set([
+	ANIMUS_ARTIFACT_DIR,
 	".next",
 	"node_modules"
 ]);
-/**
-* Start the dev watcher: fs.watch per eligible top-level directory (plus a
-* non-recursive watch on the root itself), debounced into
-* existence-partitioned modified/removed sets feeding
-* `session.handleWatchUpdate` (serialized — updates never overlap).
-* Generated and vendored trees (`.animus`, `.next`, node_modules) are never
-* registered with the OS — recursive registration of those trees exhausts
-* inotify/kqueue descriptors (EMFILE/ENOSPC) on large projects.
-* Idempotent per project root; unref'd so it never holds the process open.
-* Asynchronous FSWatcher errors degrade to no-watch with a warning instead
-* of crashing the dev server. Returns a close handle, or null when this
-* root is already watched or the platform lacks recursive fs.watch (Linux
-* before Node 20 — degrades to no-watch with a warning).
-*/
-function startTurbopackWatcher(session, rootDir, debounceMs = 75, watchFn = fs.watch) {
-	if (activeWatcherRoots.has(rootDir)) return null;
+/** Registration failures meaning the OS is out of watch capacity: descriptor
+*  and inotify limits surface under all of these. */
+const CAPACITY_CODES = /* @__PURE__ */ new Set([
+	"EMFILE",
+	"ENFILE",
+	"ENOSPC",
+	"EPERM"
+]);
+function errnoCode(error) {
+	if (!(error instanceof Object) || !("code" in error)) return null;
+	const { code } = error;
+	return isIntrinsicString(code) ? code : null;
+}
+/** A primitive string, decided by the intrinsic tag. `Object(value) !== value`
+*  rejects boxed strings and a forged `Symbol.toStringTag`. */
+function isIntrinsicString(value) {
+	return Object(value) !== value && Object.prototype.toString.call(value) === "[object String]";
+}
+function startTurbopackWatcher(session, rootDir, options = {}) {
+	const { debounceMs = 75, watchFn = fs.watch, holdEvents = false } = options;
+	if (activeWatcherRoots.has(rootDir)) return { kind: "already-watched" };
 	activeWatcherRoots.add(rootDir);
-	if (typeof session.noteDebouncedWatchEvents === "function") session.debounceCeilingMs = debounceMs;
+	session.debounceCeilingMs = debounceMs;
 	const pendingPaths = /* @__PURE__ */ new Set();
 	const watchers = /* @__PURE__ */ new Map();
 	let timer = null;
 	let updateChain = Promise.resolve();
 	let closed = false;
 	let died = false;
+	let holdingEvents = holdEvents;
 	const externalWatchers = /* @__PURE__ */ new Map();
 	let pendingOpened = /* @__PURE__ */ new Map();
 	let capturedDuringSnapshot = [];
 	const externalDiagnosticKey = (root) => `external-watch:${root}`;
 	const failureReason = (err) => {
-		const code = err?.code;
-		if (code === "EMFILE" || code === "ENFILE" || code === "ENOSPC" || code === "EPERM") return `capacity(${code})`;
+		const code = errnoCode(err);
+		if (code !== null && CAPACITY_CODES.has(code)) return `capacity(${code})`;
 		if (/inotify|too many/i.test(String(err))) return "capacity";
 		return code ?? "error";
 	};
@@ -1966,14 +1808,17 @@ function startTurbopackWatcher(session, rootDir, debounceMs = 75, watchFn = fs.w
 		const removedFiles = /* @__PURE__ */ new Set();
 		for (const path$1 of pendingPaths) ((0, fs.existsSync)(path$1) ? modifiedFiles : removedFiles).add(path$1);
 		pendingPaths.clear();
-		updateChain = updateChain.then(() => session.handleWatchUpdate({
-			modifiedFiles,
-			removedFiles
-		}).catch((err) => {
-			console.warn(`[animus-extract] Turbopack watch update failed: ${String(err)}`);
-		}).then(() => {
-			if (pendingOpened.size > 0 || capturedDuringSnapshot.length > 0) rollbackPendingExternal();
-		}));
+		updateChain = updateChain.then(() => {
+			if (closed) return;
+			return session.handleWatchUpdate({
+				modifiedFiles,
+				removedFiles
+			}).catch((err) => {
+				console.warn(`[animus-extract] watch update failed: ${String(err)}`);
+			}).then(() => {
+				if (pendingOpened.size > 0 || capturedDuringSnapshot.length > 0) rollbackPendingExternal();
+			});
+		});
 	};
 	const rollbackPendingExternal = () => {
 		for (const watcher of pendingOpened.values()) watcher.close();
@@ -2002,6 +1847,7 @@ function startTurbopackWatcher(session, rootDir, debounceMs = 75, watchFn = fs.w
 	};
 	const enqueuePath = (abs) => {
 		pendingPaths.add(abs);
+		if (holdingEvents) return;
 		try {
 			session.noteDebouncedWatchEvents?.([abs]);
 		} catch (err) {
@@ -2022,11 +1868,6 @@ function startTurbopackWatcher(session, rootDir, debounceMs = 75, watchFn = fs.w
 		} catch {}
 		enqueuePath(abs);
 	};
-	/** External-root event path: fenced by watcher identity ({watcherRootId,
-	*  generation} — a handle that is neither current nor pending belongs to
-	*  a retired generation and its events are rejected), `filename == null`
-	*  marks the ROOT dirty for rediscovery, and events observed while the
-	*  root's generation is still snapshotting are buffered for replay. */
 	const onExternalEvent = (root, self, filename) => {
 		if (closed) return;
 		const watcher = self();
@@ -2046,10 +1887,6 @@ function startTurbopackWatcher(session, rootDir, debounceMs = 75, watchFn = fs.w
 		}
 		enqueuePath(abs);
 	};
-	/** Open one external-root watcher into `into` (the committed set at
-	*  startup, the pending set during reset reconciliation). Failures
-	*  degrade ONLY this root (design D7); node_modules-resident roots are
-	*  documented unwatchable and never registered (guardrail G2). */
 	const openExternalWatcher = (root, into) => {
 		if (root.split(/[\\/]/).includes("node_modules")) return;
 		try {
@@ -2078,7 +1915,7 @@ function startTurbopackWatcher(session, rootDir, debounceMs = 75, watchFn = fs.w
 	} catch (err) {
 		closeAll();
 		console.warn(`[animus-extract] Turbopack dev watcher unavailable (${String(err)}); source edits require a dev-server restart`);
-		return null;
+		return { kind: "unavailable" };
 	}
 	for (const root of session.externalWatchRoots ?? []) openExternalWatcher(root, externalWatchers);
 	session.onExternalRootResolved = (root) => {
@@ -2103,14 +1940,25 @@ function startTurbopackWatcher(session, rootDir, debounceMs = 75, watchFn = fs.w
 			return died;
 		},
 		onDied: null,
+		deliverHeldEvents: () => {
+			holdingEvents = false;
+			if (pendingPaths.size > 0) flush();
+			return updateChain;
+		},
 		settle: () => updateChain
 	};
-	return handle;
+	return {
+		kind: "started",
+		handle
+	};
 }
 //#endregion
+exports.ANIMUS_ARTIFACT_DIR = ANIMUS_ARTIFACT_DIR;
 exports.ANIMUS_CSS_MODULE_ID = ANIMUS_CSS_MODULE_ID;
 exports.CLI_COMMIT_ARTIFACT = CLI_COMMIT_ARTIFACT;
 exports.CLI_LOCK_ARTIFACT = CLI_LOCK_ARTIFACT;
+exports.CLI_LOCK_HEARTBEAT_INTERVAL_MS = CLI_LOCK_HEARTBEAT_INTERVAL_MS;
+exports.CLI_LOCK_STALE_AFTER_MS = CLI_LOCK_STALE_AFTER_MS;
 exports.ExtractionSession = ExtractionSession;
 exports.MANIFEST_ARTIFACT = MANIFEST_ARTIFACT;
 exports.SESSION_ASSETS_DIR = SESSION_ASSETS_DIR;
@@ -2120,10 +1968,11 @@ exports.TURBOPACK_SYSTEM_PROPS_ID = TURBOPACK_SYSTEM_PROPS_ID;
 exports.analysisCommitPath = analysisCommitPath;
 exports.analysisInputsPath = analysisInputsPath;
 exports.analysisStatusPath = analysisStatusPath;
-exports.claimExclusiveSessionOwner = claimExclusiveSessionOwner;
+exports.checkLockLiveness = checkLockLiveness;
 exports.collectSessionAssets = collectSessionAssets;
+exports.decodeCommitRecord = decodeCommitRecord;
 exports.engineApi = engineApi;
-exports.getAnalysisPromise = getAnalysisPromise;
+exports.getAnalysisStartedPromise = getAnalysisStartedPromise;
 exports.getAnalyzedHashes = getAnalyzedHashes;
 exports.getManifestJson = getManifestJson;
 exports.getReplacementEpoch = getReplacementEpoch;
@@ -2132,13 +1981,17 @@ exports.getSharedCss = getSharedCss;
 exports.getSharedExternalDirs = getSharedExternalDirs;
 exports.getSharedExternalEntries = getSharedExternalEntries;
 exports.getSharedSystemProps = getSharedSystemProps;
+exports.holdDirectoryClaim = holdDirectoryClaim;
+exports.isLockHolderAlive = isLockHolderAlive;
+exports.lockRecordBytes = lockRecordBytes;
 exports.manifestPath = manifestPath;
 exports.pruneStaleAssets = pruneStaleAssets;
+exports.readCliLockRecord = readCliLockRecord;
 exports.readJsonEnvelope = readJsonEnvelope;
 exports.replacementEpochPath = replacementEpochPath;
 exports.runSessionPipeline = runSessionPipeline;
 exports.sessionArtifactDir = sessionArtifactDir;
-exports.setAnalysisPromise = setAnalysisPromise;
+exports.setAnalysisStartedPromise = setAnalysisStartedPromise;
 exports.setSharedEngine = setSharedEngine;
 exports.startTurbopackWatcher = startTurbopackWatcher;
 exports.stylesPath = stylesPath;