@astrosheep/keiyaku 2.9.11 → 2.9.13

package/build/core/repository-ledger/fold-repository.js

@@ -216,15 +216,14 @@ function validateAfterPrerequisites(ledger, contracts, isolatedContracts, diseas
             const bindTransaction = containingTransactions.get(bindObjectId);
             const ready = state.bind.data.after.every((dependency) => {
                 const prerequisite = contracts.get(dependency);
-                const terminalTransaction = prerequisite?.terminalObjectId === null
+                const prerequisiteBindTransaction = prerequisite === undefined
                     ? undefined
-                    : containingTransactions.get(prerequisite?.terminalObjectId ?? "");
+                    : containingTransactions.get(prerequisite.entryObjectIds[0]);
                 return prerequisite !== undefined &&
                     valid.has(dependency) &&
-                    prerequisite.terminalObjectId !== null &&
-                    terminalTransaction !== undefined &&
+                    prerequisiteBindTransaction !== undefined &&
                     bindTransaction !== undefined &&
-                    isTypedLedgerAncestor(ledger, terminalTransaction, bindTransaction);
+                    isTypedLedgerAncestor(ledger, prerequisiteBindTransaction, bindTransaction);
             });
             if (ready) {
                 valid.add(contract);
@@ -240,7 +239,7 @@ function validateAfterPrerequisites(ledger, contracts, isolatedContracts, diseas
             objectId: bindObjectId,
             code: "causal-prerequisite",
             contract,
-            detail: `after prerequisites were not terminal in typed ancestry: ${state.bind.data.after.join(", ")}`,
+            detail: `after prerequisite binds were not in typed ancestry: ${state.bind.data.after.join(", ")}`,
         });
         contracts.delete(contract);
         isolatedContracts.add(contract);

package/build/core/repository-ledger/identity.js

@@ -0,0 +1,60 @@
+export function repositoryLedgerHead(value) {
+    return value;
+}
+export function lifecycleTransactionId(value) {
+    return value;
+}
+export function contractHead(value) {
+    return value;
+}
+export function carrierDigest(value) {
+    if (!/^[0-9a-f]{64}$/.test(value)) {
+        throw new Error("carrier digest must be a lowercase SHA-256 hex value");
+    }
+    return value;
+}
+export function carrierInputIdentity(input) {
+    return {
+        surface: "carrier",
+        contractId: input.contractId,
+        contractHead: input.contractHead,
+        bodyDigest: input.bodyDigest,
+    };
+}
+export function carrierRetirementInputIdentity(input) {
+    return { surface: "carrier-retirement", ...input };
+}
+export function worktreeInputIdentity(input) {
+    return {
+        surface: "worktree",
+        contractId: input.contractId,
+        contractHead: input.contractHead,
+        deliveryHead: input.deliveryHead,
+    };
+}
+export function contractViewInputIdentity(input) {
+    return {
+        surface: "contract-view",
+        contractId: input.contractId,
+        contractHead: input.contractHead,
+    };
+}
+export function narrowIgnoreInputIdentity(input) {
+    return { surface: "narrow-ignore", ...input };
+}
+export function renewDeliveryInputIdentity(input) {
+    return { surface: "renew-delivery", ...input };
+}
+export function taskBoardInputIdentity(input) {
+    return { surface: "task-board", ...input };
+}
+export function deliveryRefInputIdentity(input) {
+    return { surface: "delivery-ref", ...input };
+}
+export function targetWorktreeInputIdentity(input) {
+    return { surface: "target-worktree", ...input };
+}
+/** Structural equality keeps surface comparisons independent of process-local receipts. */
+export function sameInputIdentity(left, right) {
+    return left !== null && JSON.stringify(left) === JSON.stringify(right);
+}

package/build/core/repository-ledger/inventory.js

@@ -295,12 +295,12 @@ export function activeWorkspaceHereContracts(read) {
 }
 /** Runtime ignore projection for one worktree from a single typed repository fold. */
 export function inventoryIgnorePatternsForWorktree(read, targetLifecycle) {
-    if (read.observedLedgerHead !== targetLifecycle.observedLedgerHead) {
-        throw new Error("narrow-ignore inventory requires one repository-ledger observation");
-    }
     const acceptedTarget = read.contracts.find(({ contract }) => contract === targetLifecycle.contract);
     if (!acceptedTarget)
         throw new Error(`contract ${targetLifecycle.contract} is absent from narrow-ignore inventory`);
+    if (acceptedTarget.contractHead !== targetLifecycle.contractHead) {
+        throw new Error("narrow-ignore inventory requires the current contract semantic head");
+    }
     const target = foldedWorktreeCoordinate(acceptedTarget);
     const required = target.workspace === "here"
         ? activeWorkspaceHereContracts(read).length > 0

package/build/core/repository-ledger/read-model.js

@@ -1,9 +1,11 @@
 import { openTaskAdmissionEvidenceReader, readTaskAdmissionEvidenceAtCommit, } from "../task/settlement-git.js";
 import { repositoryDeliveryRef, } from "./codec.js";
+import { bindEffectiveScope } from "./fold.js";
 import { observeRepositoryLedgerHead, readAcceptedRepositoryFold } from "./accepted-fold-read.js";
-import { advanceRepositoryCurrentState, discardRepositoryCurrentState, publishRepositoryCurrentState, readPinnedCurrentContract, readPinnedRepositoryLifecycle, readRepositoryCurrentStateNodeIds, readRepositoryCurrentStatePin } from "./current-state-store.js";
+import { advanceRepositoryCurrentState, publishRepositoryCurrentState, readPinnedCurrentContract, readPinnedRepositoryLifecycle, readRepositoryCurrentStateNodeIds, readRepositoryCurrentStatePin, readRepositoryCurrentStatePredecessor } from "./current-state-store.js";
 import { IncrementalLedgerValidationError, readIncrementalRepositorySegment } from "./incremental-read.js";
 import { RepositoryObjectError } from "./git-object-store.js";
+import { contractHead, repositoryLedgerHead } from "./identity.js";
 /** Public lifecycle state derived only from the accepted repository-ledger fold. */
 export function currentLifecycleState(model) {
     switch (model.phase) {
@@ -22,6 +24,50 @@ export function currentLifecycleState(model) {
             return { state: "forfeited" };
     }
 }
+/** Purely advance an admitted repository snapshot with its just-committed bind. */
+export function advanceRepositorySnapshotWithBind(input) {
+    const { repository, ledgerHead, entryObjectId, entry } = input;
+    const bootstrap = entry.data.workspace === "worktree" ? entry.data.bootstrap : undefined;
+    const model = deepFreeze({
+        contractHead: contractHead(entryObjectId),
+        contract: entry.contract,
+        phase: "active",
+        intent: { arc: 0, openedBy: entry.actor, title: entry.data.title, objective: entry.data.objective, brief: null },
+        receiptSegments: [],
+        seal: null,
+        bootstrapReplay: bootstrap
+            ? { state: "pending", plan: { command: [...bootstrap.command], timeoutMs: bootstrap.timeoutMs } }
+            : { state: "not-planned" },
+        petition: { state: "none" },
+        verdict: null,
+        pins: { base: entry.data.base, delivery: entry.data.base, target: { ref: entry.data.target, approvedHead: null } },
+        effectiveScope: bindEffectiveScope(entry),
+        causal: { after: [...(entry.data.after ?? [])], needs: null },
+        resources: {
+            deliveryRef: repositoryDeliveryRef(entry.contract),
+            worktree: entry.data.workspace === "worktree" ? { place: entry.data.place, state: "held" } : null,
+            tasks: [...(entry.data.taskIds ?? [])].map((taskId) => ({ taskId, state: "held" })),
+        },
+        history: [{ objectId: entryObjectId, entry: structuredClone(entry) }],
+    });
+    return deepFreeze({
+        ...structuredClone(repository),
+        observedLedgerHead: ledgerHead,
+        contracts: [...repository.contracts, model].sort((left, right) => left.contract.localeCompare(right.contract)),
+        topology: {
+            head: ledgerHead,
+            nodes: [...repository.topology.nodes, {
+                    objectId: ledgerHead,
+                    type: "transaction",
+                    ledgerParents: repository.observedLedgerHead ? [repository.observedLedgerHead] : [],
+                    verb: "bind",
+                    contract: entry.contract,
+                    entryObjectIds: [entryObjectId],
+                    finalEntryObjectId: entryObjectId,
+                }],
+        },
+    });
+}
 function deepFreeze(value) {
     if (value === null || typeof value !== "object" || Object.isFrozen(value))
         return value;
@@ -199,14 +245,14 @@ function bootstrapReplay(state) {
     }
     throw new Error(`failed bootstrap for ${state.contract} has no folded replay disposition`);
 }
-function lifecycleModel(observedLedgerHead, state, nodes, taskAdmissionEvidence) {
+function lifecycleModel(_observedLedgerHead, state, nodes, taskAdmissionEvidence) {
     const history = acceptedHistory(state, nodes);
     const verdict = findLastRow(history, "verdict");
     const released = state.terminalObjectId !== null;
     const taskReleased = state.terminal?.kind === "forfeit";
     const selectedTasks = [...(state.bind.data.taskIds ?? [])];
     return deepFreeze({
-        observedLedgerHead,
+        contractHead: contractHead(state.entryObjectIds.at(-1)),
         contract: state.contract,
         phase: state.phase,
         intent: currentIntent(state, history),
@@ -359,22 +405,25 @@ async function recoverRepositoryLifecycle(cwd, options = {}) {
     });
 }
 export async function readRepositoryLifecycle(cwd, options = {}) {
-    const observe = options.observeHead ?? observeRepositoryLedgerHead;
+    const observe = options.observedHead !== undefined
+        ? async () => options.observedHead
+        : options.observeHead ?? observeRepositoryLedgerHead;
     const observedHead = await observe(cwd);
     const injected = options.observeHead !== undefined || options.readTaskAdmissionEvidence !== undefined;
     if (!injected) {
         const pinned = await readPinnedRepositoryLifecycle(cwd, observedHead, options.signal, { includeTopology: options.includeTopology });
         if (pinned)
             return deepFreeze(pinned);
-        const priorHead = await readRepositoryCurrentStatePin(cwd, options.signal);
+        const candidatePriorHead = observedHead === null ? null : await readRepositoryCurrentStatePredecessor(cwd, observedHead, options.signal);
+        const priorHead = candidatePriorHead === null ? null : await readRepositoryCurrentStatePin(cwd, candidatePriorHead, options.signal);
         if (priorHead && observedHead && priorHead !== observedHead) {
             try {
                 const acceptedObjectIds = await readRepositoryCurrentStateNodeIds(cwd, priorHead, options.signal);
                 const segment = await readIncrementalRepositorySegment(cwd, priorHead, observedHead, options.signal, acceptedObjectIds ?? undefined);
                 if (segment && await advanceRepositoryCurrentState(cwd, priorHead, observedHead, segment, {
                     signal: options.signal,
-                    confirmHead: () => observeRepositoryLedgerHead(cwd),
-                    materialize: (state, history) => materializeIncrementalContract(cwd, observedHead, state, history),
+                    confirmHead: options.observedHead !== undefined ? async () => observedHead : () => observeRepositoryLedgerHead(cwd),
+                    materialize: (state, history) => materializeIncrementalContract(cwd, repositoryLedgerHead(observedHead), state, history),
                 })) {
                     const advanced = await readPinnedRepositoryLifecycle(cwd, observedHead, options.signal, { includeTopology: options.includeTopology });
                     if (advanced)
@@ -391,7 +440,6 @@ export async function readRepositoryLifecycle(cwd, options = {}) {
                     || (error instanceof RepositoryObjectError && error.reason !== "git-failure");
                 if (!untrustedDelta)
                     throw error;
-                await discardRepositoryCurrentState(cwd, options.signal);
             }
         }
     }
@@ -404,7 +452,7 @@ export async function readRepositoryLifecycle(cwd, options = {}) {
     if (!injected) {
         const published = await publishRepositoryCurrentState(cwd, recovered, {
             signal: options.signal,
-            confirmHead: () => observeRepositoryLedgerHead(cwd),
+            confirmHead: options.observedHead !== undefined ? async () => observedHead : () => observeRepositoryLedgerHead(cwd),
             fold: recoveredFold,
         });
         if (!published)

package/build/core/repository-ledger/write-transaction.js

@@ -1,7 +1,7 @@
 import { runGitProcess } from "../../git/core.js";
 import { commitRefTransaction, } from "../../git/refs.js";
 import { REPOSITORY_LEDGER_REF, evidenceObjectId, formatLifecycleEntry, formatLifecycleTransaction, repositoryDeliveryRef, } from "./codec.js";
-import { assertHostObjectId, assertReadableCommit, deriveHostGitCoordinates, } from "./git-object-store.js";
+import { assertHostObjectId, assertReadableCommit, assertReadableCommitClosure, deriveHostGitCoordinates, } from "./git-object-store.js";
 import { assertHonestClaimEvidence } from "./claim-evidence.js";
 import { transactionMembershipError } from "./transaction-membership.js";
 function replayFailure(effect, error) {
@@ -76,26 +76,26 @@ async function assertAuthoritativeCommitTipClosure(cwd, coordinates, operations)
         if (operation.kind !== "update" || operation.ref === REPOSITORY_LEDGER_REF || checked.has(operation.newOid))
             continue;
         assertHostObjectId(coordinates, operation.newOid);
-        await assertReadableCommit(cwd, coordinates, operation.newOid);
+        await assertReadableCommitClosure(cwd, operation.newOid);
         checked.add(operation.newOid);
     }
 }
-export async function buildLifecycleEntry(cwd, entry, expectedLedgerHead) {
-    const coordinates = await deriveHostGitCoordinates(cwd);
+export async function buildLifecycleEntry(cwd, entry, expectedLedgerHead, coordinates) {
+    const resolvedCoordinates = coordinates ?? await deriveHostGitCoordinates(cwd);
     if (expectedLedgerHead !== null)
-        assertHostObjectId(coordinates, expectedLedgerHead);
+        assertHostObjectId(resolvedCoordinates, expectedLedgerHead);
     const evidence = evidenceObjectId(entry);
     if (evidence !== null) {
-        assertHostObjectId(coordinates, evidence);
-        await assertReadableCommit(cwd, coordinates, evidence);
+        assertHostObjectId(resolvedCoordinates, evidence);
+        await assertReadableCommit(cwd, resolvedCoordinates, evidence);
     }
     const parents = [
         ...(expectedLedgerHead === null ? [] : [expectedLedgerHead]),
         ...(evidence === null ? [] : [evidence]),
     ];
-    const args = ["commit-tree", coordinates.emptyTree, ...parents.flatMap((parent) => ["-p", parent])];
+    const args = ["commit-tree", resolvedCoordinates.emptyTree, ...parents.flatMap((parent) => ["-p", parent])];
     const result = await runGitProcess(cwd, args, {
-        input: formatLifecycleEntry(entry, coordinates.objectFormat),
+        input: formatLifecycleEntry(entry, resolvedCoordinates.objectFormat),
         env: {
             GIT_AUTHOR_NAME: "Keiyaku",
             GIT_AUTHOR_EMAIL: "keiyaku@localhost",
@@ -110,16 +110,17 @@ export async function buildLifecycleEntry(cwd, entry, expectedLedgerHead) {
         throw new Error(`cannot build ${entry.kind} ledger object: ${detail}`, { cause: result.error });
     }
     const objectId = result.stdout.trim();
-    assertHostObjectId(coordinates, objectId);
-    return { entry, objectId, expectedLedgerHead, parents, coordinates };
+    assertHostObjectId(resolvedCoordinates, objectId);
+    return { entry, objectId, expectedLedgerHead, parents, coordinates: resolvedCoordinates };
 }
-export async function buildLifecycleTail(cwd, entries, expectedLedgerHead) {
+export async function buildLifecycleTail(cwd, entries, expectedLedgerHead, coordinates) {
     if (entries.length === 0)
         throw new Error("a lifecycle tail requires at least one entry");
+    const resolvedCoordinates = coordinates ?? await deriveHostGitCoordinates(cwd);
     const built = [];
     let parent = expectedLedgerHead;
     for (const entry of entries) {
-        const next = await buildLifecycleEntry(cwd, entry, parent);
+        const next = await buildLifecycleEntry(cwd, entry, parent, resolvedCoordinates);
         built.push(next);
         parent = next.objectId;
     }
@@ -199,7 +200,8 @@ async function buildTransactionTail(input) {
         throw new Error(`bind transaction repeats contract ${contract}`);
     if (input.verb !== "bind" && causalParent === null)
         throw new Error(`${input.verb} transaction has no accepted lifecycle predecessor for ${contract}`);
-    const tail = await buildLifecycleTail(input.cwd, input.entries, causalParent);
+    const coordinates = await deriveHostGitCoordinates(input.cwd);
+    const tail = await buildLifecycleTail(input.cwd, input.entries, causalParent, coordinates);
     const transaction = await buildLifecycleTransactionNode({
         cwd: input.cwd,
         verb: input.verb,
@@ -246,6 +248,7 @@ async function publishLifecycleWrite(cwd, builtTransaction, final, ownedOperatio
         completion: replay.status,
         ledgerHead: builtTransaction.objectId,
         entry: final.entry,
+        entryObjectId: final.objectId,
         authoritativeOperations,
         authorityProof: transaction.proof,
         authorityObservations: transaction.observations,
@@ -278,6 +281,9 @@ export async function publishBindTransaction(input) {
         { kind: "update", ref: input.delivery.ref, newOid: input.delivery.head, expectedOldOid: null },
     ];
     if (input.taskBoard) {
+        if (input.taskBoard.ref !== input.entry.data.target) {
+            throw new Error("task-selected bind task-board ref must equal the entry target");
+        }
         operations.push({
             kind: "update",
             ref: input.taskBoard.ref,
@@ -311,11 +317,12 @@ export async function publishAuthoritativeTransaction(cwd, transaction, options
     const entry = final.entry;
     const operations = [];
     if (transaction.verb === "renew" && entry.kind === "renew") {
-        assertAuthority("delivery" in transaction, "renew transaction must pin its delivery ref");
+        assertAuthority("delivery" in transaction && "target" in transaction, "renew transaction must pin its target and delivery refs");
+        assertAuthority(transaction.target.expectedOid === entry.data.newBase, "renew target CAS must equal newBase");
         assertAuthority(transaction.delivery.ref === repositoryDeliveryRef(entry.contract), "renew delivery ref does not name its contract");
         assertAuthority(transaction.delivery.expectedOid === entry.data.oldHead, "renew delivery CAS must equal oldHead");
         assertAuthority(entry.data.oldHead !== entry.data.newHead, "renew must replace the delivery head");
-        operations.push({ kind: "update", ref: transaction.delivery.ref, expectedOldOid: transaction.delivery.expectedOid, newOid: entry.data.newHead });
+        operations.push({ kind: "verify", ref: transaction.target.ref, expectedOldOid: transaction.target.expectedOid }, { kind: "update", ref: transaction.delivery.ref, expectedOldOid: transaction.delivery.expectedOid, newOid: entry.data.newHead });
     }
     else if (transaction.verb === "forfeit") {
         assertAuthority(entry.kind === "forfeit", "forfeit transaction must end in a forfeit entry");
@@ -331,7 +338,7 @@ export async function publishAuthoritativeTransaction(cwd, transaction, options
         assertAuthority(transaction.target.expectedOid === entry.data.targetHead, "claim target CAS must equal targetHead");
         assertAuthority(transaction.delivery.ref === repositoryDeliveryRef(entry.contract), "claim delivery ref does not name its contract");
         assertAuthority(transaction.delivery.expectedOid === entry.data.deliveryHead, "claim delivery CAS must equal deliveryHead");
-        await assertHonestClaimEvidence(cwd, entry.data);
+        await assertHonestClaimEvidence(cwd, entry.data, { coordinates: built.transaction.coordinates });
         operations.push({ kind: "update", ref: transaction.target.ref, expectedOldOid: transaction.target.expectedOid, newOid: entry.data.mergeCommit }, { kind: "delete", ref: transaction.delivery.ref, expectedOldOid: transaction.delivery.expectedOid });
     }
     const write = await publishLifecycleWrite(cwd, built.transaction, final, operations, options.replayPlan, options.transactionRunner);

package/build/core/run-control/connection-bound-close.js

@@ -0,0 +1,41 @@
+export function beginConnectionBoundRunnerClose(database, lease) {
+    database.exec("BEGIN IMMEDIATE");
+    let open = true;
+    let leaseOwnership = "retained";
+    const rollback = () => {
+        open = false;
+        database.exec("ROLLBACK");
+    };
+    return {
+        get leaseOwnership() { return leaseOwnership; },
+        commit() {
+            if (!open)
+                throw new Error("connection-bound runner close is not open");
+            try {
+                lease.close();
+            }
+            catch (error) {
+                leaseOwnership = "unknown";
+                rollback();
+                throw error;
+            }
+            leaseOwnership = "consumed";
+            try {
+                database.exec("COMMIT");
+                open = false;
+            }
+            catch (error) {
+                rollback();
+                throw error;
+            }
+        },
+        rollback() {
+            if (leaseOwnership !== "retained") {
+                throw new Error(`connection-bound runner lease ownership is ${leaseOwnership}`);
+            }
+            if (!open)
+                throw new Error("connection-bound runner close is no longer open");
+            rollback();
+        },
+    };
+}

package/build/core/run-control/detached-lease-bootstrap.js

@@ -0,0 +1,208 @@
+import { launchDetachedProcess } from "./detached-process.js";
+import { terminateProcessGroup } from "./process-tree.js";
+import { acquireRunnerLeaseTransferTarget, observeRunnerLease, } from "./runner-lease.js";
+export const RUN_CONTROL_BOOTSTRAP_ENV = "KEIYAKU_RUN_CONTROL_BOOTSTRAP";
+function detail(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function send(child, message) {
+    return new Promise((resolve, reject) => {
+        if (!child.send || !child.connected)
+            return reject(new Error("bootstrap channel is unavailable"));
+        child.send(message, (error) => error ? reject(error) : resolve());
+    });
+}
+function waitForMessage(child, coordinate, expected, deadline, now, setTimer, clearTimer) {
+    return new Promise((resolve, reject) => {
+        const cleanup = () => {
+            child.off("message", onMessage);
+            child.off("error", onError);
+            child.off("exit", onExit);
+            clearTimer(timer);
+        };
+        const onMessage = (value) => {
+            const message = value;
+            if (message.coordinate !== coordinate || message.kind !== expected)
+                return;
+            cleanup();
+            resolve();
+        };
+        const onError = (error) => { cleanup(); reject(error); };
+        const onExit = () => onError(new Error("child exited during bootstrap"));
+        const remaining = deadline - now();
+        const timer = setTimer(() => onError(new Error(`bootstrap deadline passed before ${expected}`)), Math.max(0, remaining));
+        child.on("message", onMessage);
+        child.on("error", onError);
+        child.on("exit", onExit);
+    });
+}
+async function stop(child, prefix, terminate) {
+    try {
+        await terminate(child);
+        return { status: "failed", stage: "transfer", detail: prefix };
+    }
+    catch (error) {
+        return { status: "failed", stage: "cleanup", detail: `${prefix}; termination could not be verified: ${detail(error)}` };
+    }
+}
+export async function openDetachedLeaseBootstrap(input) {
+    const terminate = input.terminate ?? terminateProcessGroup;
+    const now = input.now ?? Date.now;
+    let child;
+    try {
+        child = launchDetachedProcess(input.launch, input.spawn);
+    }
+    catch (error) {
+        try {
+            input.parentLease.close();
+            return { status: "failed", stage: "spawn", detail: detail(error) };
+        }
+        catch (closeError) {
+            return { status: "failed", stage: "cleanup", detail: `${detail(error)}; parent lease release failed: ${detail(closeError)}` };
+        }
+    }
+    const ready = waitForMessage(child, input.coordinate, "transfer-ready", input.deadline, now, setTimeout, clearTimeout);
+    const acquired = waitForMessage(child, input.coordinate, "ownership-acquired", input.deadline, now, setTimeout, clearTimeout);
+    void acquired.catch(() => { });
+    try {
+        await ready;
+    }
+    catch (error) {
+        let failure = detail(error);
+        try {
+            input.parentLease.close();
+        }
+        catch (closeError) {
+            failure += `; parent lease release failed: ${detail(closeError)}`;
+        }
+        return stop(child, failure, terminate);
+    }
+    let decision;
+    let result;
+    return {
+        status: "ready",
+        bootstrap: {
+            child,
+            async authorize() {
+                if (decision === "reject")
+                    return { status: "failed", stage: "transfer", detail: "bootstrap was already rejected" };
+                if (decision)
+                    return result;
+                decision = "authorize";
+                result = (async () => {
+                    let transferFailure;
+                    let transferMayBeOwnedByChild = false;
+                    try {
+                        input.parentLease.releaseReservationForTransfer();
+                        await send(child, { kind: "promote", coordinate: input.coordinate });
+                        transferMayBeOwnedByChild = true;
+                        try {
+                            input.parentLease.close();
+                        }
+                        catch (error) {
+                            transferFailure = error;
+                        }
+                        try {
+                            await acquired;
+                        }
+                        catch (error) {
+                            transferFailure ??= error;
+                        }
+                        if (transferFailure && observeRunnerLease(input.leasePath).state !== "held")
+                            throw transferFailure;
+                        await send(child, { kind: "authorize", coordinate: input.coordinate });
+                        return { status: "authorized", child };
+                    }
+                    catch (error) {
+                        try {
+                            input.parentLease.close();
+                        }
+                        catch { /* cleanup detail is secondary to transfer failure */ }
+                        if (transferMayBeOwnedByChild && observeRunnerLease(input.leasePath).state === "held") {
+                            try {
+                                await send(child, { kind: "authorize", coordinate: input.coordinate });
+                            }
+                            catch { /* held lease already proves authority */ }
+                            return { status: "authorized", child };
+                        }
+                        return stop(child, detail(error), terminate);
+                    }
+                })();
+                return result;
+            },
+            async reject() {
+                if (decision === "authorize")
+                    return { status: "failed", stage: "transfer", detail: "bootstrap was already authorized" };
+                if (decision)
+                    return result;
+                decision = "reject";
+                result = (async () => {
+                    try {
+                        await send(child, { kind: "reject", coordinate: input.coordinate });
+                    }
+                    catch { /* termination proves rejection */ }
+                    let failure = "launch rejected";
+                    try {
+                        input.parentLease.close();
+                    }
+                    catch (error) {
+                        failure += `; parent lease release failed: ${detail(error)}`;
+                    }
+                    const stopped = await stop(child, failure, terminate);
+                    return stopped.stage === "cleanup" ? stopped : { status: "rejected" };
+                })();
+                return result;
+            },
+        },
+    };
+}
+function sendUpstream(message) {
+    return new Promise((resolve, reject) => {
+        if (!process.send || !process.connected)
+            return reject(new Error("bootstrap channel is unavailable"));
+        process.send(message, (error) => error ? reject(error) : resolve());
+    });
+}
+function receive(coordinate, expected) {
+    return new Promise((resolve, reject) => {
+        const cleanup = () => {
+            process.off("message", onMessage);
+            process.off("disconnect", onDisconnect);
+        };
+        const onDisconnect = () => { cleanup(); reject(new Error("bootstrap channel disconnected")); };
+        const onMessage = (value) => {
+            const message = value;
+            if (message.coordinate !== coordinate || (message.kind !== expected && message.kind !== "reject"))
+                return;
+            cleanup();
+            resolve(message);
+        };
+        process.on("message", onMessage);
+        process.on("disconnect", onDisconnect);
+    });
+}
+export async function receiveDetachedLease(input) {
+    if (process.env[RUN_CONTROL_BOOTSTRAP_ENV] !== "1")
+        throw new Error("process lacks bootstrap authority");
+    let target;
+    let lease;
+    try {
+        target = acquireRunnerLeaseTransferTarget(input.leasePath);
+        await sendUpstream({ kind: "transfer-ready", coordinate: input.coordinate });
+        if ((await receive(input.coordinate, "promote")).kind === "reject")
+            return { status: "rejected" };
+        lease = target.promote();
+        target = undefined;
+        await sendUpstream({ kind: "ownership-acquired", coordinate: input.coordinate });
+        if ((await receive(input.coordinate, "authorize")).kind === "reject")
+            return { status: "rejected" };
+        process.disconnect?.();
+        const owned = lease;
+        lease = undefined;
+        return { status: "authorized", lease: owned };
+    }
+    finally {
+        lease?.close();
+        target?.close();
+    }
+}

package/build/core/run-control/detached-process.js

@@ -0,0 +1,14 @@
+import { spawn as nodeSpawn } from "node:child_process";
+/** Launches a process in its own POSIX process group when the platform supports it. */
+export function launchDetachedProcess(input, spawnProcess = nodeSpawn) {
+    const child = spawnProcess(input.command, input.args, {
+        ...input.options,
+        detached: process.platform !== "win32",
+    });
+    if (child.pid === undefined) {
+        throw new Error("detached process did not expose a process id");
+    }
+    if (input.unref)
+        child.unref();
+    return child;
+}

package/build/core/run-control/index.js

@@ -0,0 +1,6 @@
+export { PROCESS_GROUP_KILL_GRACE_MS, ProcessTreeTerminationError, ownedProcessIdentity, ownedProcessIsLive, terminateOwnedProcess, terminateProcessGroup, } from "./process-tree.js";
+export { launchDetachedProcess, } from "./detached-process.js";
+export { openDetachedLeaseBootstrap, receiveDetachedLease, RUN_CONTROL_BOOTSTRAP_ENV, } from "./detached-lease-bootstrap.js";
+export { initializeRunnerLeaseDatabase, acquireRunnerLease, acquireRunnerLeaseTransferTarget, acquireRunnerLostProof, observeRunnerLease, RunnerLeaseUnavailableError, } from "./runner-lease.js";
+export { beginConnectionBoundRunnerClose, } from "./connection-bound-close.js";
+export { acquireSqliteProcessLifetimeLock, initializeSqliteProcessLifetimeLockDatabase, isSqliteProcessLifetimeLockContention, openSqliteProcessLifetimeLockTransaction, SqliteProcessLifetimeLockError, sqliteProcessLifetimeLockErrorDetail, } from "./sqlite-process-lifetime-lock.js";

package/build/core/{process-group.js → run-control/process-tree.js}

@@ -88,7 +88,7 @@ async function terminateIdentity(identity, options) {
         throw new Error(`owned process group ${identity.pid} remained after SIGKILL`);
     }
 }
-/** Terminate an orphaned runner identity retained by repository coordination. */
+/** Terminate an orphaned process identity retained by caller-owned coordination. */
 export async function terminateOwnedProcess(identity, options = {}) {
     try {
         await terminateIdentity(identity, {